bombobombone/cve-2026-73319Proof-of-concept exploit and technical write-up for CVE-2026-73319, a same-host javascript: URI XSS in XenForo before 2.3.13, including reproduction steps and a Python PoC script.
XenForo before 2.3.13 accepts a same-host javascript: URI as a dynamic redirect and later assigns it to window.location.
Server-side redirect validation rejects foreign hosts but does not require HTTP or HTTPS. A URL shaped as javascript://board-host/%0A... parses with the XenForo host, passes that comparison, and survives into the AJAX response. In the browser, percent-decoding turns %0A into a line break, ending the JavaScript line comment introduced by //host and exposing the payload that follows.
I reproduced this with the public Follow confirmation on XenForo 2.3.12 (build 2031270). A logged-in user opened the crafted URL and confirmed Follow; the harmless payload set window.name in the XenForo origin. The attacker needs no account, but the victim must be logged in and confirm the normal action. XenForo 2.3.13 contains the fix.
python poc.py https://xenforo.example member-name.123
The script starts a one-request loopback redirect server. Open the printed URL while logged in, confirm Follow, and inspect window.name.
Discovered by Marco Paciaroni (BomboBombone).