CyberRota Analysis
AI-GeneratedXenForo versions prior to 2.3.13 are vulnerable to an OAuth2 authorization code reuse flaw, allowing attackers to exploit the system by using previously issued authorization codes to obtain unauthorized token pairs. This vulnerability undermines the single-use guarantee of the OAuth2 flow, potentially granting attackers access to user data and resources. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use guarantee of the OAuth2 authorization code flow.
Related CVEs
Other vulnerabilities affecting the same vendor(s)