Description

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing the caller to treat the fabricated request as verified and process the payment event without a valid PayPal signature.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-08T14:17:25.640Z",
  "pubdate": "2026-09-08T14:17:25.640Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to an authentication bypass vulnerability within the PayPal REST webhook integration. The flaw originates from an improper implementation of cryptographic signature verification logic. Specifically, the system fails to handle unsupported 'auth_algo' header values gracefully, defaulting to a truthy return value when the algorithm mapping fails.\nThis vulnerability allows unauthenticated remote attackers to forge malicious webhook requests that mimic legitimate PayPal payment events. By injecting an unsupported algorithm identifier, an attacker can coerce the signature validation routine to return a successful status without performing any cryptographic verification. Consequently, the application processes these fraudulent payloads as authentic, potentially leading to unauthorized credit issuance, subscription activation, or service fulfillment. The risk is critical, as it bypasses the primary security mechanism designed to ensure the integrity and authenticity of payment notifications. Exploitation does not require prior authentication or elevated privileges, and the attack can be executed over the network by anyone capable of sending a crafted HTTP request to the webhook endpoint.",
  "technicalDetails": "The vulnerability resides within the signature verification component of the XenForo PayPal REST webhook handler. The core issue is a logic flaw in the handling of the 'auth_algo' header parameter, which dictates the cryptographic algorithm used for signature verification. When a request is received, the application attempts to resolve this header value to a corresponding hash function. If the provided algorithm is unsupported or unrecognized by the system, the verification function experiences a failure in the mapping logic.\nInstead of adhering to a secure 'fail-closed' paradigm—where any error in the verification process would result in the rejection of the request—the implementation defaults to a successful return state. By returning 'true' in the event of an algorithm lookup failure, the function signals to the caller that the request signature is valid. The calling process, operating under the assumption that the webhook has been cryptographically verified against the PayPal public key, proceeds to parse and execute the actions defined within the payload.\nThe attack flow proceeds as follows: First, an attacker identifies the publicly accessible endpoint responsible for handling PayPal REST webhooks. Second, the attacker crafts a malicious JSON payload representing a successful payment notification (e.g., 'PAYMENT.SALE.COMPLETED'). Third, the attacker transmits this payload via an HTTP POST request to the target endpoint, explicitly setting the 'auth_algo' header to an unsupported or malformed value. Finally, the server-side code enters the vulnerable verification block, fails to map the algorithm, returns 'true', and subsequently triggers the associated business logic, such as updating user subscription status or crediting the account balance.\nThe scope of this vulnerability includes all XenForo deployments using the native PayPal REST API integration prior to version 2.3.13. Because the vulnerability exists at the entry point of the webhook processing logic, it is directly exposed to the public internet. No authentication is required to initiate this request, and there are no complex prerequisites other than knowledge of the webhook URL. The impact is significant, as it enables the manipulation of payment-related state within the database without actual funds being transferred, leading to direct financial and service-related loss."
}