XenForo 2.3.12 build 2031270 processed the same authenticated PayPal REST webhook more than once. Replaying one signed payment-completion callback created duplicate transaction records and extended the associated recurring user upgrade twice.
Technical details
XenForo’s base payment code already checks whether a provider transaction was processed. The PayPal REST override of validateTransaction() skipped that implementation, and the database accepted duplicate transaction IDs.
Once signature verification passed, purchase completion ran without checking whether the provider event had already been processed.
Reproduction
- Send the callback once and record the new expiry date.
- Replay the exact request.
- Compare the payment log and expiry date again.
Both requests succeeded. XenForo logged the same provider transaction twice and extended the upgrade after each request.
Impact
Anyone able to capture one authentic callback with its original signature could replay that callback to repeat its payment-side effect. For recurring user upgrades, each replay extended the expiry date again.
XenForo added transaction replay protection in 2.3.13.
References
XenForo 2.3.12 build 2031270 processed the same authenticated PayPal REST webhook more than once. Replaying one signed payment-completion callback created duplicate transaction records and extended the associated recurring user upgrade twice.
## Technical details
XenForo's base payment code already checks whether a provider transaction was processed. The PayPal REST override of `validateTransaction()` skipped that implementation, and the database accepted duplicate transaction IDs.
Once signature verification passed, purchase completion ran without checking whether the provider event had already been processed.
## Reproduction
1. Send the callback once and record the new expiry date.
2. Replay the exact request.
3. Compare the payment log and expiry date again.
Both requests succeeded. XenForo logged the same provider transaction twice and extended the upgrade after each request.
## Impact
Anyone able to capture one authentic callback with its original signature could replay that callback to repeat its payment-side effect. For recurring user upgrades, each replay extended the expiry date again.
XenForo added transaction replay protection in 2.3.13.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73316)
- [PoC](https://github.com/BomboBombone/CVE-2026-73316)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-payment-replay-via-paypal-rest-payment-provider)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe