VYPR
← All advisories
High severity8.8NVD Advisory· Published Apr 1, 2026· Updated Apr 1, 2026

CVE-2025-71278

CVE-2025-71278

Description

XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Xenforo/Xenforo2 versions
    cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*range: >=2.3.0,<2.3.5
    • (no CPE)range: >=2.3.0, <2.3.5

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.