CVE-2026-73314: PayPal signature check bypass

PAYPAL-AUTH-ALGO: definitely-not-a-real-algorithm

I sent XenForo a made-up PayPal completion event with an unknown signature algorithm. The request added 30 days to a recurring user upgrade.

No PayPal signing key was involved. The interesting header was:

```http
PAYPAL-AUTH-ALGO: definitely-not-a-real-algorithm
```

## The skipped check

`PayPalRest::verifyWebhookSignature()` mapped `PAYPAL-AUTH-ALGO` through an allowlist containing `SHA256withRSA`. An unknown name left the OpenSSL algorithm unset. The null branch logged that verification had been skipped and returned `true`.

The webhook handler then processed `PAYMENT.CAPTURE.COMPLETED` as a real PayPal event.

A normal buyer could collect the other values needed for the request. The cancellation link exposed the purchase-request key, and the upgrade page supplied the amount and currency. I used those values in a synthetic callback and watched the expiry date move forward.

## Reproducing it

The [public PoC](https://github.com/BomboBombone/CVE-2026-73314) sends one completion event with an unsupported algorithm to an existing PayPal REST recurring upgrade.

XenForo 2.3.13 rejects unknown algorithms and unavailable cryptographic support.

## Links

- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73314)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-signature-verification-bypass-via-paypal-rest-webhook)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)