bombobombone/cve-2026-73314Proof-of-concept exploit for CVE-2026-73314, a PayPal REST webhook signature verification bypass in XenForo before 2.3.13, allowing unauthorized purchase completion.
XenForo before 2.3.13 fails open when a PayPal REST webhook names an unsupported signature algorithm.
The webhook handler maps PAYPAL-AUTH-ALGO through a small allowlist. If the value is unknown, the mapped algorithm becomes null. Instead of rejecting the request, the verification path logs that the algorithm is unavailable and returns success. Certificate fetching and openssl_verify() are never reached.
With an active PayPal REST recurring upgrade, a buyer can obtain the purchase request key from their own recurring-upgrade controls. A forged PAYMENT.CAPTURE.COMPLETED callback containing that key, the displayed amount/currency, and an unsupported algorithm can reach normal purchase completion without a valid PayPal signature.
I reproduced a 30-day entitlement extension on XenForo 2.3.12 (build 2031270). The PoC does not target a real payment account and should be used only with a disposable upgrade in an isolated installation. XenForo 2.3.13 contains the fix.
python poc.py https://xenforo.example DISPOSABLE_REQUEST_KEY 10.00 USD
The script creates one synthetic event and reports only the HTTP status. A fixed installation should reject it.
Discovered by Marco Paciaroni (BomboBombone).