XenForo 2.3.12 build 2031270 did not bind an OAuth2 authorization code to the redirect URI used during authorization. A code issued for one registered callback could be redeemed through another callback registered to the same client.
Technical details
XenForo stored the selected redirect URI on the OAuthRequest. During token redemption, the server only checked whether the submitted redirect_uri appeared in the client’s allowlist. It did not compare that value with the URI attached to the authorization request that issued the code.
Reproduction
- Register callback A and callback B on the same client.
- Authorize with callback A.
- Exchange the resulting code while sending callback B.
- Use the returned token at
/api/me.
The token endpoint returned an access token, and the token authenticated as the user who authorized through callback A.
Impact
An attacker with a valid authorization code and control of another registered callback could redeem the code through that callback. Relevant cases include abandoned endpoints and custom URI schemes claimed by another application. The attack does not bypass the requirement for a valid code.
XenForo 2.3.13 binds the submitted redirect URI to the authorization request that produced the code.
References
XenForo 2.3.12 build 2031270 did not bind an OAuth2 authorization code to the redirect URI used during authorization. A code issued for one registered callback could be redeemed through another callback registered to the same client.
## Technical details
XenForo stored the selected redirect URI on the `OAuthRequest`. During token redemption, the server only checked whether the submitted `redirect_uri` appeared in the client's allowlist. It did not compare that value with the URI attached to the authorization request that issued the code.
## Reproduction
1. Register callback A and callback B on the same client.
2. Authorize with callback A.
3. Exchange the resulting code while sending callback B.
4. Use the returned token at `/api/me`.
The token endpoint returned an access token, and the token authenticated as the user who authorized through callback A.
## Impact
An attacker with a valid authorization code and control of another registered callback could redeem the code through that callback. Relevant cases include abandoned endpoints and custom URI schemes claimed by another application. The attack does not bypass the requirement for a valid code.
XenForo 2.3.13 binds the submitted redirect URI to the authorization request that produced the code.
## References
- [CVE-2026-73310](https://www.cve.org/CVERecord?id=CVE-2026-73310)
- [PoC](https://github.com/BomboBombone/CVE-2026-73310)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-oauth2-authorization-code-token-theft-via-redirect-uri-bypass)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe