bombobombone/cve-2026-73313Proof-of-concept exploit for CVE-2026-73313, an MFA bypass in XenForo's passkey TFA provider allowing account takeover after password compromise.
XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user.
The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies that credential's WebAuthn signature. The TFA provider then reduces the result to a boolean without checking that the credential owner matches the user whose password login is pending.
An attacker who knows a target's correct password can answer the target's passkey challenge with the attacker's own registered passkey. Login completes as the target. The shared flow also affected ACP login when the target was an administrator.
This is an MFA bypass after first-factor compromise, not a passwordless takeover. The attacker needs their own valid passkey, the target's password, and a target account configured for passkey TFA.
I reproduced both public and ACP flows on XenForo 2.3.12 (build 2031270). XenForo 2.3.13 contains the fix.
Install the dependencies and supply two users plus a passkey registered to the attacker account:
python -m pip install -r requirements.txt
python poc.py https://xenforo.example TARGET_USERNAME ATTACKER_CREDENTIAL_ID attacker-private-key.pem
The target password is read from a prompt. Add --include-acp to test the ACP login flow.
Discovered by Marco Paciaroni (BomboBombone).