CVE-2026-73319: JavaScript URI in dynamic redirects

javascript://board.example/%0Awindow.name='marker';void 0

XenForo's redirect validator compared the host and accepted every URL scheme. A crafted `javascript:` URL looked same-hosted to PHP and executable to the browser.

The payload I used was:

```text
javascript://board.example/%0Awindow.name='marker';void 0
```

## Two parsers, two interpretations

PHP parsed `board.example` as the host, so XenForo's same-host check accepted the string. The browser handled everything after `//` as a JavaScript comment. `%0A` ended that comment, and the remaining code ran when XenForo assigned the value to `window.location`.

The validator already rejected a different host, raw newlines, and user-info tricks using `@`. None of those checks dealt with the scheme at the start of the URL.

I reached the redirect through XenForo's public Follow confirmation flow. Anyone could prepare the link. Script execution followed when a logged-in user opened it and confirmed the action.

The [public PoC](https://github.com/BomboBombone/CVE-2026-73319) serves the crafted Follow URL from a one-request redirector and uses `window.name` to show that the script ran.

XenForo limited the accepted schemes in 2.3.13.

## Links

- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73319)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-xss-via-dynamic-redirect-handler)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)