XenForo 2.3.12 build 2031270 accepted a javascript: URI as a same-host redirect target. A logged-in user who opened an attacker-prepared Follow confirmation link and confirmed the action executed JavaScript in the XenForo origin.
Technical details
The redirect validator used PHP’s URL parser to compare the supplied host with the board host but did not restrict the URI scheme. The following payload passed that check:
javascript://board.example/%0Awindow.name='marker';void 0
PHP parsed board.example as the host, so XenForo’s same-host check accepted it. The browser treated everything after // as a JavaScript comment. %0A ended the comment, and the remaining code ran when XenForo assigned the value to window.location.
Reproduction
- Serve a Follow confirmation URL whose return target contains the payload above.
- Open the link in a browser with an authenticated XenForo session.
- Confirm the Follow action.
- The browser executes the JavaScript in the XenForo origin as it follows the redirect.
Impact
An attacker could execute JavaScript in the context of a logged-in XenForo user who opened the prepared link and confirmed the action. The payload ran with the user’s access to the board origin.
XenForo limited the accepted schemes in 2.3.13.
References
XenForo 2.3.12 build 2031270 accepted a `javascript:` URI as a same-host redirect target. A logged-in user who opened an attacker-prepared Follow confirmation link and confirmed the action executed JavaScript in the XenForo origin.
## Technical details
The redirect validator used PHP's URL parser to compare the supplied host with the board host but did not restrict the URI scheme. The following payload passed that check:
```text
javascript://board.example/%0Awindow.name='marker';void 0
```
PHP parsed `board.example` as the host, so XenForo's same-host check accepted it. The browser treated everything after `//` as a JavaScript comment. `%0A` ended the comment, and the remaining code ran when XenForo assigned the value to `window.location`.
## Reproduction
1. Serve a Follow confirmation URL whose return target contains the payload above.
2. Open the link in a browser with an authenticated XenForo session.
3. Confirm the Follow action.
4. The browser executes the JavaScript in the XenForo origin as it follows the redirect.
## Impact
An attacker could execute JavaScript in the context of a logged-in XenForo user who opened the prepared link and confirmed the action. The payload ran with the user's access to the board origin.
XenForo limited the accepted schemes in 2.3.13.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73319)
- [PoC](https://github.com/BomboBombone/CVE-2026-73319)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-xss-via-dynamic-redirect-handler)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe