CVE-2026-73312: Refresh token replay after access-token expiry

XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired.

What happens

XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the replacement token family, then asks the parent access-token revoker to consume the old family. That revoker returns early when the access token is expired, before revoking the related refresh token.

The original refresh token can consequently be submitted again, producing another independent token family with the same user and scopes. The attacker must already possess a valid refresh token (and the client secret for a confidential client). The issue extends a compromised credential's useful lifetime; it is not a login bypass or scope escalation by itself.

I reproduced the issue on XenForo 2.3.12 (build 2031270) after allowing the parent access token to expire. XenForo 2.3.13 contains the fix.

Proof of concept

python poc.py https://xenforo.example CLIENT_ID REFRESH_TOKEN --verify-me

The script submits one refresh token twice and reports whether XenForo issued two different access tokens.