Auth bypass in Xenforo
CVE-2026-73313
XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (vendor-advisory, patch)
- disclosure@vulncheck.com (release-notes)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (exploit)
Frequently asked questions
- What is CVE-2026-73313?
- CVE-2026-73313 is a medium-severity vulnerability in Xenforo, classified under Incorrect Authorization. CVSS score: 6.8/10. Published 2026-09-08.
- How severe is CVE-2026-73313?
- Medium severity. CVSS v3 base score is 6.8 out of 10.
- Is CVE-2026-73313 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.