CVE-2026-73310: OAuth2 redirect URI not bound to authorization code

XenForo before 2.3.13 does not bind an OAuth2 authorization code to the redirect URI used when that code was issued.

What happens

At the token endpoint, XenForo checks that the submitted redirect_uri is somewhere in the client's allowlist. It does not compare the value with the redirect URI stored on the authorization request. A client with callbacks A and B can therefore authorize through A and redeem the code while claiming B.

An attacker must control or observe a valid code and a different callback already registered to the same client. The bug does not create a code or add a new redirect URI. It weakens the binding between the front-channel authorization and the token exchange.

I reproduced the mismatch on XenForo 2.3.12 (build 2031270): callback A issued the code, callback B exchanged it, and the resulting token authenticated as the authorizing user. XenForo 2.3.13 contains the fix.

Proof of concept

python poc.py https://xenforo.example CLIENT_ID AUTHORIZATION_CODE https://client.example/callback-b --code-verifier VERIFIER

Use --client-secret for a confidential client. A vulnerable installation accepts callback B; a fixed installation rejects the mismatch.