bombobombone/cve-2026-73309Proof-of-concept and technical write-up for CVE-2026-73309, an OAuth2 authentication bypass in XenForo before 2.3.13. Demonstrates empty client-secret and PKCE verification bypass with a Python script.
XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint.
The endpoint checks whether client_secret and code_verifier keys exist, then performs the comparisons only when their PHP string values are truthy. An empty value therefore satisfies the presence check but bypasses the comparison.
For a public OAuth client, an attacker still needs a valid authorization code. The bug removes the PKCE guarantee that the code alone is insufficient: the code can be exchanged without the verifier, producing tokens with the scopes approved by the user. The same falsey-value pattern affected confidential-client checks.
I reproduced the issue on XenForo 2.3.12 (build 2031270) in an authorized local installation. XenForo 2.3.13 contains the fix.
The script performs one token exchange with an empty code_verifier, hashes any returned access token, and checks whether it authenticates. It never prints the token or account identity.
python poc.py https://xenforo.example CLIENT_ID AUTHORIZATION_CODE https://client.example/callback
A vulnerable installation returns HTTP 200 from the token endpoint and an authenticated response from /api/me. A fixed installation rejects the exchange.
Use only an authorization code created for a disposable account on a system you are authorized to test.
Discovered by Marco Paciaroni (BomboBombone).