XenForo 2.3.12 build 2031270 treated an unsupported PayPal webhook signature algorithm as a successful verification. A forged PAYMENT.CAPTURE.COMPLETED callback extended a recurring user upgrade without a PayPal signing key.
Technical details
PayPalRest::verifyWebhookSignature() mapped PAYPAL-AUTH-ALGO through an allowlist containing SHA256withRSA. An unknown value left the OpenSSL algorithm unset. That branch logged that verification had been skipped and returned true, allowing the webhook handler to process the event.
The relevant header was:
PAYPAL-AUTH-ALGO: definitely-not-a-real-algorithm
Reproduction
- Create an active PayPal REST recurring user upgrade.
- Build a
PAYMENT.CAPTURE.COMPLETED callback for that purchase context.
- Set
PAYPAL-AUTH-ALGO to an unsupported value and send the callback without a valid PayPal signature.
- Check the user’s upgrade expiry date.
The callback returned success and extended the recurring upgrade by 30 days. The purchase values used by the callback were available to the buyer through the upgrade and cancellation flows.
Impact
A buyer could forge a completed-payment callback for their purchase context and extend the related user upgrade without a valid PayPal signature.
XenForo 2.3.13 rejects unsupported algorithms and unavailable cryptographic verification.
References
XenForo 2.3.12 build 2031270 treated an unsupported PayPal webhook signature algorithm as a successful verification. A forged `PAYMENT.CAPTURE.COMPLETED` callback extended a recurring user upgrade without a PayPal signing key.
## Technical details
`PayPalRest::verifyWebhookSignature()` mapped `PAYPAL-AUTH-ALGO` through an allowlist containing `SHA256withRSA`. An unknown value left the OpenSSL algorithm unset. That branch logged that verification had been skipped and returned `true`, allowing the webhook handler to process the event.
The relevant header was:
```http
PAYPAL-AUTH-ALGO: definitely-not-a-real-algorithm
```
## Reproduction
1. Create an active PayPal REST recurring user upgrade.
2. Build a `PAYMENT.CAPTURE.COMPLETED` callback for that purchase context.
3. Set `PAYPAL-AUTH-ALGO` to an unsupported value and send the callback without a valid PayPal signature.
4. Check the user's upgrade expiry date.
The callback returned success and extended the recurring upgrade by 30 days. The purchase values used by the callback were available to the buyer through the upgrade and cancellation flows.
## Impact
A buyer could forge a completed-payment callback for their purchase context and extend the related user upgrade without a valid PayPal signature.
XenForo 2.3.13 rejects unsupported algorithms and unavailable cryptographic verification.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73314)
- [PoC](https://github.com/BomboBombone/CVE-2026-73314)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-signature-verification-bypass-via-paypal-rest-webhook)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe