High severity7.4NVD Advisory· Published Sep 8, 2026
CVE-2026-73312
CVE-2026-73312
Description
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
3- www.vulncheck.com/advisories/xenforo-refresh-token-replay-via-expired-access-tokennvd
- xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/nvd
- xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/nvd
News mentions
0No linked articles in our index yet.