CVE-2026-73313 is a multi-factor authentication bypass in the XenForo passkey provider. The passkey check looked up credentials globally, so an attacker who knows a target password can sign in with their own passkey. The record scores it 6.8, Medium. Upgrade to XenForo 2.3.13 or later.
What's affected
The record and VulnCheck both say XenForo before 2.3.13 is affected. The vendor announcement links in the record were blocked by a browser check when we tried to read them. The address of one vendor thread suggests that security fixes were also released for the 2.2 line, covering versions 2.2.0 through 2.3.12. We could not read its text, so confirm the fixed version for your line in the vendor thread before you rely on it.
The weakness is in the passkey two step provider. During the WebAuthn assertion step, the code looks up the submitted credential across all users and does not check that it belongs to the user whose login is pending. An attacker who knows a target's password can sign the challenge with their own registered passkey and complete the login. The record says this works on both the public forum and the admin control panel login paths. The attacker needs an account of their own with a registered passkey.
The weakness class is CWE-863, incorrect authorization.
How to check if you're exposed
Find the XenForo version on each site. The admin control panel home page shows the installed version, and so does the footer of the admin pages. Compare it with 2.3.13.
Next, check whether passkeys are enabled for your members, since the flaw sits in that provider. Look at the two step verification options in your admin control panel. If passkeys are not offered and no accounts have them, the exposure is narrower, but upgrade anyway.
Review your admin accounts. An attacker who also knows an administrator password could use this to reach the admin control panel, so those accounts need the most care. The free in-browser scan at gold.safeguard.sh/scan accepts a manifest and lists known CVEs for the packages it finds.
What to do now
- Upgrade XenForo to 2.3.13 or later, or to the fixed release for your line named in the vendor announcement.
- Update add-ons that the vendor released with the security fixes.
- Review login history for admin and moderator accounts, looking for sign ins from unfamiliar places.
- Make sure staff passwords are unique, and reset any that appear in breach lists.
- Consider limiting admin control panel access to known networks while you patch.
- Recheck after the upgrade that passkey login works as expected for your own account.
Why it matters
Multi-factor checks only help if the second factor is tied to the same person as the first. Here the second step accepted any valid passkey in the system, so it proved that someone was registered, not that the right person was present. This is the kind of bug that appears when a credential lookup is written to be convenient and loses its user filter.
The sources differ on severity. The record gives 6.8 Medium under CVSS 3.1, with high attack complexity. VulnCheck lists it as high at 7.6 under CVSS 4.0. The attacker needs the password first, which limits reach, but passwords leak often. On a forum with staff accounts, treat it as a priority. The record also lists a public write up and a proof of concept from the researcher, so details are available. No source says it has been exploited in the wild, and the CVE is not on the CISA KEV list.
Quick check
What does an attacker need besides a passkey of their own?
The target account's password, according to the record.
Which version fixes it?
XenForo 2.3.13 for the 2.3 line. Confirm the fixed release for other lines in the vendor announcement.
Sources
Last reviewed: 18 October 2026.
