Description

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-08T14:17:25.220Z",
  "pubdate": "2026-09-08T14:17:25.220Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to an OAuth2 authorization code reuse vulnerability. This flaw stems from a failure to enforce the single-use requirement mandated by the OAuth2 specification (RFC 6749).\nBy failing to invalidate or mark authorization codes as consumed immediately upon the initial token exchange, the application allows an attacker to reuse a previously intercepted authorization code to request additional, independent access and refresh token pairs.\nThis vulnerability effectively compromises the security guarantees of the OAuth2 authorization code flow. An attacker capable of intercepting a legitimate user's authorization code—via network sniffing, logs, or browser history—can escalate this into unauthorized persistent access to the user's account.\nSuccessful exploitation results in unauthorized token issuance, granting the attacker the same permissions and scope as the legitimate user without requiring further authentication. This presents a critical risk to user session integrity and overall platform security, as the attacker gains the ability to impersonate the victim or perform actions on their behalf, independent of the original authentication session.",
  "technicalDetails": "The vulnerability resides within the XenForo OAuth2 server implementation, specifically in the logic handling the exchange of authorization codes for access and refresh tokens. According to RFC 6749, the authorization code must be used only once; the authorization server is required to revoke all tokens issued based on a previously used code if a reuse attempt is detected. XenForo fails to perform this state validation.\nThe root cause is a deficiency in the state tracking mechanism for authorization codes. When a client application submits an authorization code to the /token endpoint, the server verifies the code's validity but fails to transition the code to a 'consumed' or 'revoked' state within the backend database or cache. Consequently, the code remains active and valid for repeated token exchange requests.\nExploitation involves a race condition or direct reuse scenario. An attacker who successfully intercepts an authorization code during the initial browser-based redirection flow—typically via man-in-the-middle (MITM) attacks on insecure connections, malicious browser extensions, or access to sensitive logs—can submit the same authorization code to the token endpoint multiple times.\nThe attack flow proceeds as follows: 1) The legitimate user initiates an OAuth2 flow and receives an authorization code from the server. 2) The attacker intercepts this code. 3) The legitimate client application successfully exchanges the code for a token pair. 4) Simultaneously or subsequently, the attacker submits the exact same authorization code to the XenForo token endpoint. 5) Because the server does not check for prior usage, it treats the attacker's request as a valid new authorization event. 6) The server issues a new, independent set of access and refresh tokens to the attacker.\nThis behavior bypasses the single-use guarantee, allowing an attacker to maintain persistent access even if the legitimate user's session is terminated or their tokens are invalidated. The vulnerability is present in all XenForo installations prior to version 2.3.13 that utilize the built-in OAuth2 provider functionality. Authentication to the endpoint is technically satisfied by the presence of the valid (though reused) authorization code, which acts as the primary credential for token issuance in this flow. Post-exploitation, the attacker possesses valid tokens, enabling unauthorized access to the victim's account resources governed by the requested scopes."
}