bombobombone/cve-2026-73316Proof-of-concept and technical write-up for CVE-2026-73316, a PayPal REST webhook replay vulnerability in XenForo before 2.3.13, including reproduction steps and fix details.
XenForo before 2.3.13 processes the same valid PayPal REST webhook more than once.
The PayPal REST provider overrides XenForo's base transaction validator but omits its duplicate transaction-log lookup. The database index is also non-unique. Two byte-identical, validly signed deliveries with one transaction ID can therefore run purchase completion twice.
I reproduced this on XenForo 2.3.12 (build 2031270) using a recurring upgrade. Both callbacks returned HTTP 200, created separate payment log rows, and extended the same entitlement. The attacker model requires an authentic callback or a legitimate provider retry/resend; this bug does not forge the signature.
XenForo 2.3.13 contains the fix.
Store one callback body and its headers locally, then run:
python poc.py https://xenforo.example headers.json callback.json
The script sends the same callback twice and prints both HTTP statuses.
Discovered by Marco Paciaroni (BomboBombone).