I set up two XenForo accounts. One owned a passkey; the other used passkeys for two-step verification.
After entering the second account’s password, I finished its login with the first account’s passkey. The same sequence worked on the public login and in the ACP on XenForo 2.3.12 build 2031270.
The signature was valid for the wrong user
The passkey manager looked up the credential ID globally and verified its challenge, origin, RP ID, signature, presence flag, and counter. Every cryptographic check passed.
The credential record also contained its owner’s user_id. The TFA provider skipped that field, returned success, and opened the pending user’s session.
WebAuthn correctly validated the attacker’s credential. XenForo then attached that valid assertion to the wrong login. Reaching the bug required the target’s password, an attacker-owned registered passkey, and a target account configured for passkey TFA.
The PoC drives that two-account login. XenForo 2.3.13 rejects a credential unless its owner matches the account completing authentication.
Links
I set up two XenForo accounts. One owned a passkey; the other used passkeys for two-step verification.
After entering the second account's password, I finished its login with the first account's passkey. The same sequence worked on the public login and in the ACP on XenForo 2.3.12 build 2031270.
## The signature was valid for the wrong user
The passkey manager looked up the credential ID globally and verified its challenge, origin, RP ID, signature, presence flag, and counter. Every cryptographic check passed.
The credential record also contained its owner's `user_id`. The TFA provider skipped that field, returned success, and opened the pending user's session.
WebAuthn correctly validated the attacker's credential. XenForo then attached that valid assertion to the wrong login. Reaching the bug required the target's password, an attacker-owned registered passkey, and a target account configured for passkey TFA.
The [PoC](https://github.com/BomboBombone/CVE-2026-73313) drives that two-account login. XenForo 2.3.13 rejects a credential unless its owner matches the account completing authentication.
## Links
- [CVE-2026-73313](https://www.cve.org/CVERecord?id=CVE-2026-73313)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-mfa-bypass-via-passkey-tfa-provider)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe