Description

XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-08T14:17:25.073Z",
  "pubdate": "2026-09-08T14:17:25.073Z",
  "executiveSummary": "An authorization bypass vulnerability exists in XenForo before version 2.3.13 within its implementation of the OAuth2 token endpoint. This security flaw stems from a validation failure during the redirect URI binding verification process, allowing malicious actors to circumvent critical authorization controls.\nSpecifically, an attacker who has control over any single allowlisted redirect URI associated with an OAuth2 client configuration can bypass the binding requirements by submitting a different allowlisted URI than the one initially recorded at the time of authorization.\nConsequently, if an attacker successfully intercepts a valid authorization code from an ongoing user flow, they can exchange that code via the token endpoint using the mismatched redirect URI. This enables the attacker to steal OAuth2 access and refresh tokens, leading to unauthorized session access, privilege escalation, and potential account takeover.\nTo successfully execute this exploit, the attacker must be positioned to intercept the authorization flow's code and must have control or access to at least one valid, allowlisted redirect URI configured under the target application's profile.",
  "technicalDetails": "The vulnerability is situated within the authorization code grant implementation of XenForo's OAuth2 framework, specifically prior to version 2.3.13. Under standard RFC 6749 guidelines, when a client application exchanges an authorization code for an access token at the token endpoint, the server must validate that the 'redirect_uri' parameter in the token request is identical to the 'redirect_uri' parameter sent during the initial authorization request. This strict matching prevents code replay and authorization hijacking.\nIn vulnerable versions of XenForo, the server-side validation logic in the token endpoint fails to enforce this strict transactional binding between the issued authorization code and its originating redirect URI. Instead, the endpoint's logic simply verifies whether the incoming 'redirect_uri' is present within the broader global allowlist defined for the corresponding client ID.\nThis validation gap enables a multi-stage attack flow:\n1. A legitimate user initiates an authentication or authorization flow against the XenForo server, resulting in the generation of a temporary authorization code bound to their designated redirect URI.\n2. The attacker intercepts this authorization code through secondary vectors, such as exploiting local storage access, analyzing browser history, abusing Referer headers, or leveraging network positions on unsecured channels.\n3. Once in possession of the authorization code, the attacker crafts an out-of-band POST request targeting the XenForo OAuth2 token endpoint.\n4. In this request, the attacker includes the stolen authorization code but alters the 'redirect_uri' parameter, replacing the victim's URI with an alternate URI that is also allowlisted for that client, but which the attacker directly controls or can monitor.\n5. Due to the lack of transaction-specific matching, the XenForo server checks the attacker's URI against the client's general allowlist. Because the URI is validly registered on the client profile, the validation check passes.\n6. The server completes the exchange, generating and returning active OAuth2 access and refresh tokens to the attacker.\n7. With these tokens, the attacker can masquerade as the victim, accessing protected resources and APIs with the full privileges granted by the stolen authorization context."
}