Fiche vulnérabilité
CVE-2026-73310 : faille moyenne xenforo xenforo (CVSS 5.9)
Description
XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect URI to bypass redirect URI binding by submitting a different allowlisted URI than the one recorded at authorization time. Attackers can exchange an intercepted authorization code using a mismatched redirect URI to steal OAuth2 tokens from intercepted authorization flows.
En bref
- Sévérité
- Moyenne (CVSS 5.9)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Exploitation active
- Non signalée par la CISA
- Publication
- 8 sept. 2026
- Dernière mise à jour
- 11 sept. 2026
Produits concernés
- xenforo xenforo