CVE-2026-73310

Katalog CVE

CVSS 5.9 · Medium EPSS 0,49%

Kerentanan Incorrect Authorization pada xenforo. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.

Rincian

Terbit di NVD

8 September 2026

Terakhir diubah

11 September 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bombobombone.github.io/posts/cve-2026-73310/ exploit · advisory pihak ketiga
• https://github.com/BomboBombone/CVE-2026-73310 exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-token-theft-via-redirect-uri-bypass advisory pihak ketiga
• https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0... release notes
• https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/ release notes