XenForo 2.3.12 build 2031270 allowed a refresh token to be reused after its associated access token expired. Each replay issued a new access-token and refresh-token pair with the same user and scopes.
Technical details
The refresh endpoint created the replacement pair and then called the old access token’s revocation routine. That routine started by checking whether the access token was still valid. An expired token failed immediately, so the function returned before revoking anything—including the related refresh token.
Reproduction
- Obtain a valid OAuth2 access token and its refresh token.
- Wait for the access token to expire.
- Submit the refresh token and record the replacement pair.
- Submit the original refresh token again.
- Verify both returned access tokens at
/api/me.
Both refresh requests succeeded, and the original refresh token remained usable.
Impact
Anyone holding the refresh token could continue creating valid token pairs after the parent access token expired. Confidential clients still required their client secret.
XenForo 2.3.13 consumes the refresh token independently of its expired parent and issues the replacement in the same operation.
References
XenForo 2.3.12 build 2031270 allowed a refresh token to be reused after its associated access token expired. Each replay issued a new access-token and refresh-token pair with the same user and scopes.
## Technical details
The refresh endpoint created the replacement pair and then called the old access token's revocation routine. That routine started by checking whether the access token was still valid. An expired token failed immediately, so the function returned before revoking anything—including the related refresh token.
## Reproduction
1. Obtain a valid OAuth2 access token and its refresh token.
2. Wait for the access token to expire.
3. Submit the refresh token and record the replacement pair.
4. Submit the original refresh token again.
5. Verify both returned access tokens at `/api/me`.
Both refresh requests succeeded, and the original refresh token remained usable.
## Impact
Anyone holding the refresh token could continue creating valid token pairs after the parent access token expired. Confidential clients still required their client secret.
XenForo 2.3.13 consumes the refresh token independently of its expired parent and issues the replacement in the same operation.
## References
- [CVE-2026-73312](https://www.cve.org/CVERecord?id=CVE-2026-73312)
- [PoC](https://github.com/BomboBombone/CVE-2026-73312)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-token)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe