CVE-2026-73315: PayPal certificate URL SSRF

PAYPAL-CERT-URL: https://listener.example/cert.pem

I changed a PayPal callback's `PAYPAL-CERT-URL` to a server I controlled. My listener received a request from the XenForo host.

`PAYPAL-CERT-URL` normally points to the certificate used to verify PayPal's signature. XenForo fetched it before deciding whether the callback was genuine.

## The fetch

The handler passed the header straight to its HTTP client, accepting arbitrary HTTP and HTTPS locations, including private addresses and non-PayPal hosts.

```http
PAYPAL-CERT-URL: https://listener.example/cert.pem
```

XenForo sent the GET and then parsed the response as a certificate. A normal web page failed certificate parsing after my listener had recorded the connection.

Serving a certificate with its private key makes it possible to build a matching signature. Full payment forgery also requires the merchant's configured webhook ID and a valid purchase context. The public PoC stops after recording the server-side fetch.

The [public PoC](https://github.com/BomboBombone/CVE-2026-73315) replaces the certificate header with a URL you control and records the request.

XenForo restricted certificate retrieval in 2.3.13.

## Links

- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73315)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-ssrf-via-paypal-rest-webhook-handler)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)