CVE-2026-73312
highXenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to…
Vendor / product: Xenforo — xenforo
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected products
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://bombobombone.github.io/posts/cve-2026-73312/ disclosure@vulncheck.com
- https://github.com/BomboBombone/CVE-2026-73312 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token disclosure@vulncheck.com
- https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-ga... disclosure@vulncheck.com
- https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-securit... disclosure@vulncheck.com