bombobombone/cve-2026-73311Proof-of-concept exploit demonstrating OAuth2 authorization code reuse in XenForo before 2.3.13, allowing token replay and multiple token families.
XenForo before 2.3.13 allows an OAuth2 authorization code to be redeemed more than once.
The authorization-code grant loads a code, verifies its time-based validity, and creates a token pair. The successful path does not delete the code, mark it consumed, or use an atomic one-time update. Replaying the same valid exchange therefore creates an independent access/refresh-token family for the same user and scopes.
An attacker still needs a valid authorization code and the client parameters required by that grant. This issue does not explain how the code is obtained; it makes a code reusable after the intended client has already redeemed it.
On XenForo 2.3.12 (build 2031270), two identical exchanges returned different access tokens and both authenticated successfully. XenForo 2.3.13 contains the fix.
python poc.py https://xenforo.example CLIENT_ID AUTHORIZATION_CODE https://client.example/callback --code-verifier VERIFIER
The script submits the same grant twice, hashes returned tokens, and reports whether both work. It does not print credentials or account identity. Run it only with a disposable grant on an authorized test installation.
Discovered by Marco Paciaroni (BomboBombone).