Description

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-08T14:17:25.500Z",
  "pubdate": "2026-09-08T14:17:25.500Z",
  "executiveSummary": "A critical multi-factor authentication (MFA) bypass vulnerability exists in XenForo versions prior to 2.3.13 within the passkey (WebAuthn) TFA provider. This vulnerability allows an attacker who possesses a target user's password to circumvent secondary authentication by leveraging their own registered passkey.\nThe root cause is a failure in the credential validation logic during the WebAuthn assertion process. Specifically, the system performs a global lookup of the provided passkey credential without verifying that the credential is cryptographically bound or explicitly associated with the user account currently undergoing the login process.\nThis flaw impacts both the public forum interface and the Administrative Control Panel (ACP). By successfully authenticating the secondary factor using an unauthorized credential, an attacker can gain full access to the victim's account, including administrative privileges if the target is an administrator. This bypass essentially nullifies the security benefits of hardware-backed MFA, presenting a severe risk to account integrity and platform security.\nExploitation requires knowledge of the target's primary credentials (password) and the ability to initiate an authentication session, making this a significant threat to environments relying on MFA for privilege escalation protection.",
  "technicalDetails": "The vulnerability resides in the XenForo WebAuthn/passkey implementation, specifically within the verification path used during the second step of the two-factor authentication process. When a user submits a passkey assertion, the application is responsible for identifying the credential ID provided in the signature and confirming that it is authorized for the specific user currently in the middle of the login flow.\nThe root cause is an insecure credential lookup operation. When the browser sends the WebAuthn assertion (containing the credential ID and the signature), the backend performs a search in the database for the provided credential ID. The logic fails to implement a scoping check; it does not verify that the returned credential record matches the User ID of the account being accessed. Instead, it accepts the validity of the signature globally.\nBecause WebAuthn relies on public-key cryptography, a signature generated by an attacker's private key will be cryptographically valid. When the server looks up the credential ID provided by the attacker, it finds the attacker's public key (already registered to the attacker's own account on the same XenForo instance). The verification logic confirms that the signature is valid for that public key, and since the check for association with the target account is absent, the server incorrectly treats the authentication as successful for the target user's session.\nThe attack flow follows these steps: 1) The attacker initiates a login request for a target user account for which they possess the password. 2) Upon entering the correct password, the system triggers the MFA challenge. 3) Instead of completing the challenge for the target account, the attacker submits an assertion generated by their own hardware security key or passkey device, which is registered to their own separate account on the same forum. 4) The server receives the assertion, performs a global lookup for the attacker's credential, validates the signature, and erroneously authorizes the target user's session because the verification logic fails to enforce a user-context match. 5) The attacker is granted full access to the target account. This vulnerability applies to all versions of XenForo prior to 2.3.13 and remains active across both public and administrative authentication paths, posing a critical risk of unauthorized privilege escalation and account takeover."
}