Description

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-08T14:17:25.353Z",
  "pubdate": "2026-09-08T14:17:25.353Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to a refresh token replay vulnerability due to inadequate state management in the OAuth 2.0 implementation.\nThe vulnerability allows an attacker to repeatedly utilize a single, valid refresh token to generate multiple, independent access and refresh token pairs, effectively bypassing standard rotation security mechanisms.\nThis flaw resides in the handling of refresh tokens specifically when the associated parent access token has already expired.\nBy failing to mark the used refresh token as consumed, the system allows the token to remain active beyond its intended single-use lifecycle, leading to unauthorized session persistence.\nAn attacker possessing a intercepted or leaked refresh token can maintain indefinite access to a user account for the entire duration of the token's lifetime, regardless of subsequent refresh requests.\nThe impact includes unauthorized persistent access to user accounts, potential account takeover, and the circumvention of session termination controls.\nThe vulnerability requires an attacker to have already obtained a valid refresh token through secondary means, such as network interception or local storage access, as there is no mention of an initial bypass mechanism.",
  "technicalDetails": "The root cause of this vulnerability is a logic error in the XenForo token issuance workflow involving the failure to implement atomic state transitions for refresh tokens.\nIn a secure OAuth 2.0 implementation, particularly one employing refresh token rotation, the authorization server must invalidate the previous refresh token immediately upon its use to generate a new pair.\nIn the affected XenForo versions, the logic fails to invalidate the refresh token when the associated access token has reached its expiry threshold.\nUnder normal circumstances, a client presents a refresh token to the token endpoint to exchange it for a new access token. If the system incorrectly validates the token's status, it processes the request without updating the token's consumption status in the database or cache.\nThe attack flow commences when an attacker intercepting a valid refresh token submits it to the XenForo token endpoint.\nBecause the server does not mark the token as 'used' or 'revoked' during this specific error state, the attacker can submit the same token multiple times.\nEach submission results in the server issuing a unique, valid access token and a new refresh token, while the original refresh token remains functionally active in the backend database.\nThis behavior facilitates a race condition or a sustained replay attack where the attacker can generate an arbitrary number of concurrent sessions or extend the session lifespan indefinitely by repeatedly re-submitting the original token.\nThe vulnerability affects the token authentication service within XenForo versions prior to 2.3.13.\nExploitation does not require elevated privileges, provided the attacker has acquired a valid refresh token assigned to a target account. The network exposure is limited to the public-facing token endpoint used for authentication.\nPost-exploitation, the attacker gains the ability to maintain persistent unauthorized access. Since the refresh token is never marked as consumed, the legitimate user and the attacker can both hold valid, distinct sessions, making detection difficult via simple session monitoring.\nThe failure to transition the refresh token to an exhausted state bypasses the fundamental security design of token rotation, rendering short-lived access token controls ineffective."
}