CyberRota Analysis
AI-GeneratedXenForo versions prior to 2.3.13 are vulnerable due to a logic error in the PayPal REST webhook handler, allowing unauthenticated attackers to bypass payment signature validation by exploiting an unsupported auth_algo header value. This flaw can lead to unauthorized payment processing, resulting in potential financial loss and fraud. Organizations using affected versions of XenForo should prioritize patching this vulnerability to safeguard their payment systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing the caller to treat the fabricated request as verified and process the payment event without a valid PayPal signature.
Related CVEs
Other vulnerabilities affecting the same vendor(s)