XenForo 2.3.12 build 2031270 accepted a valid passkey assertion from one user to complete another user’s pending two-step login. The issue affected both the public login flow and the admin control panel.
Technical details
The passkey manager found the credential globally and verified the challenge, origin, RP ID, signature, presence flag and counter. All of that was correct. The credential record also had the owner’s user_id, but the TFA provider never compared it with the account waiting to finish login.
Reproduction
- Register a passkey on account A.
- Enable passkey two-step verification on account B.
- Start a login for account B with B’s password.
- Complete the passkey prompt with account A’s credential.
XenForo accepted the assertion and opened a session for account B. The same sequence completed an ACP login.
Impact
An attacker who knew the target account’s password could satisfy its passkey-based second factor with a passkey registered to another account. The attacker needed control of that second account and its passkey.
XenForo 2.3.13 verifies that the credential owner matches the account being authenticated.
References
XenForo 2.3.12 build 2031270 accepted a valid passkey assertion from one user to complete another user's pending two-step login. The issue affected both the public login flow and the admin control panel.
## Technical details
The passkey manager found the credential globally and verified the challenge, origin, RP ID, signature, presence flag and counter. All of that was correct. The credential record also had the owner's `user_id`, but the TFA provider never compared it with the account waiting to finish login.
## Reproduction
1. Register a passkey on account A.
2. Enable passkey two-step verification on account B.
3. Start a login for account B with B's password.
4. Complete the passkey prompt with account A's credential.
XenForo accepted the assertion and opened a session for account B. The same sequence completed an ACP login.
## Impact
An attacker who knew the target account's password could satisfy its passkey-based second factor with a passkey registered to another account. The attacker needed control of that second account and its passkey.
XenForo 2.3.13 verifies that the credential owner matches the account being authenticated.
## References
- [CVE-2026-73313](https://www.cve.org/CVERecord?id=CVE-2026-73313)
- [PoC](https://github.com/BomboBombone/CVE-2026-73313)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-mfa-bypass-via-passkey-tfa-provider)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe