bombobombone/cve-2026-73313Proof-of-concept exploit for CVE-2026-73313, an MFA bypass in XenForo's passkey TFA provider allowing account takeover after password compromise.
XenForo before 2.3.13 can complete one user's two-step login with a passkey owned by a different user.
The passkey manager performs a global lookup using the credential ID supplied in the assertion and correctly verifies that credential's WebAuthn signature. The TFA provider then reduces the result to a boolean without checking that the credential owner matches the user whose password login is pending.
An attacker who knows a target's correct password can answer the target's passkey challenge with the attacker's own registered passkey. Login completes as the target. The shared flow also affected ACP login when the target was an administrator.
This is an MFA bypass after first-factor compromise, not a passwordless takeover. The attacker needs their own valid passkey, the target's password, and a target account configured for passkey TFA.
I reproduced both public and ACP flows on XenForo 2.3.12 (build 2031270). XenForo 2.3.13 contains the fix.
Install the two dependencies, prepare disposable attacker/target users and an attacker-owned test credential, then run:
python -m pip install -r requirements.txt
python poc.py https://xenforo.example TARGET_USERNAME ATTACKER_CREDENTIAL_ID attacker-private-key.pem
The target password is read with a hidden prompt. The script does not provision users, modify passkey rows, print the password, or write an evidence file. Its output contains only HTTP status and a final boolean.
Discovered by Marco Paciaroni (BomboBombone).