Description

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can exploit PHP truthy evaluation logic, which treats empty strings as false and skips client secret validation and PKCE code verifier validation, to exchange a valid authorization code for a token pair without proving client identity or holding the PKCE commitment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-08T14:17:24.913Z",
  "pubdate": "2026-09-08T14:17:24.913Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to an authentication bypass vulnerability located within the OAuth2 token endpoint.\nThis vulnerability is classified as an improper authentication flaw resulting from insecure handling of input parameters.\nThe vulnerability allows an unauthenticated attacker to successfully authenticate and obtain valid OAuth2 token pairs by manipulating the client_secret and code_verifier parameters.\nBy submitting empty strings, an attacker can bypass critical security checks, including client identity verification and Proof Key for Code Exchange (PKCE) validation.\nThe root cause lies in PHP's loose comparison and truthy evaluation logic, which incorrectly handles empty input values as false, causing the application to skip authentication routines.\nExploitation of this vulnerability grants unauthorized access to token pairs, potentially leading to unauthorized account access or impersonation of legitimate clients depending on the context of the OAuth2 implementation.\nThe vulnerability requires no authentication and is accessible via standard network requests to the OAuth2 endpoint.\nImmediate patching is required to restore secure validation logic for the OAuth2 exchange flow.",
  "technicalDetails": "The vulnerability resides in the XenForo OAuth2 token endpoint, specifically within the logic governing the exchange of an authorization code for an access token and refresh token pair.\nThe flaw stems from the application's reliance on PHP's loose evaluation of input parameters for sensitive security checks.\nWhen processing an OAuth2 token request, the application is designed to validate the 'client_secret' (for confidential clients) and the 'code_verifier' (to satisfy PKCE requirements).\nHowever, the implementation uses conditional logic that evaluates empty string input values as boolean false. Because the code fails to strictly differentiate between a missing parameter and an empty string value, the conditional blocks responsible for validating the 'client_secret' and 'code_verifier' are bypassed entirely.\nThe exploitation flow is as follows: 1) The attacker initiates an OAuth2 flow or obtains a valid authorization code through standard application interactions. 2) The attacker sends a POST request to the OAuth2 token endpoint. 3) Within the body of this request, the attacker explicitly includes the parameters 'client_secret' and 'code_verifier' but provides them as empty strings (''). 4) The server-side PHP logic evaluates these empty strings. Due to the vulnerable conditional structure, the checks intended to verify the secret and the PKCE challenge are skipped because the logic treats the presence of an empty string as a condition to bypass validation.\nConsequently, the server treats the request as legitimate, assuming the security checks have passed, and proceeds to issue a valid OAuth2 token pair to the unauthorized requester.\nThis vulnerability effectively renders PKCE and client secret authentication measures null, allowing an attacker to impersonate a legitimate client without possessing the necessary cryptographic material.\nThe exposure is network-based, as the token endpoint is publicly reachable by any unauthenticated entity capable of reaching the XenForo installation.\nSuccessful exploitation results in the acquisition of valid OAuth2 tokens, which may be used to perform actions on behalf of a user or application context, depending on the scope of the token generated.\nThe vulnerability affects all versions of XenForo preceding 2.3.13 that implement OAuth2 features."
}