CVE-2026-73309 is a high severity (CVSS 7.4) authentication bypass in the XenForo OAuth2 token endpoint. Sending empty values for the client secret and code verifier skips both checks. It affects XenForo before 2.3.13, so upgrade to 2.3.13 or the matching fix for the 2.2 line.
What's affected
XenForo before 2.3.13, per the NVD record and the VulnCheck advisory. XenForo's own thread announcing the security fixes covers versions 2.2.0 through 2.3.12 and the Media Gallery add-on, which suggests the 2.2 line has its own fixed build. That page did not load for me as text, so confirm the exact release for your branch there.
The flaw concerns the OAuth2 token endpoint, where an authorization code is exchanged for tokens. It matters for sites that use XenForo as an OAuth2 provider, with registered clients.
How to check if you're exposed
The administrator control panel shows the installed XenForo version on its dashboard and in the footer. Compare it with 2.3.13.
Then check whether you use OAuth2 clients at all. If you have none registered, the exposure is lower. Review the registered clients and their activity.
What to do now
- Upgrade XenForo to 2.3.13, or to the fixed release for the 2.2 line, using the vendor's thread.
- Update the Media Gallery add-on if you run it, since it was in the same release.
- Review registered OAuth2 clients and remove any you do not recognize.
- Check logs for token endpoint requests that succeeded without a client secret.
- Revoke tokens issued to clients you cannot account for.
Why it matters
The record maps this to CWE-697, incorrect comparison. The description explains it in terms of how PHP treats values. An empty string counts as false in a truthiness test, so code of the form "if a secret was supplied, check it" skipped the check when the supplied secret was empty.
The same shortcut removed the PKCE check. PKCE exists to prove that the party exchanging a code is the one that started the flow, so skipping it takes away the protection for public clients.
The safe pattern is to test whether a value is present as a separate question from whether it is correct, and to fail closed. Compare against null or use strict comparison. The KEV flag is false.
Quick check
Does CVE-2026-73309 need a login?
The record says unauthenticated attackers can obtain token pairs, though they must have a valid authorization code.
Sources
Last reviewed: 19 October 2026.
