CVE-2026-73313 json
XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider
published 2026-09-08 2 mo ago modified 2026-10-01 39 d ago also EUVD-2026-72784
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths.
Patch / fix
- XenForo XenForo 2.3.13
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 55 d ago
Exploit prediction
0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/BomboBombone/CVE-2026-73313 referenced PoC, tagged "exploit" by a source, unverified
- bombobombone.github.io https://bombobombone.github.io/posts/cve-2026-73313/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 7.6 | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected products
- XenForo XenForo
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
xenforo.com
/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/
vendor-advisory, patch, release-notes
-
github.com
/BomboBombone/CVE-2026-73313
exploit, third-party-advisory
-
bombobombone.github.io
/posts/cve-2026-73313/
technical-description, exploit, third-party-advisory
-
xenforo.com
/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/
release-notes
-
vulncheck.com
/advisories/xenforo-mfa-bypass-via-passkey-tfa-provider
third-party-advisory
Sources
- CVE List CVE-2026-73313
- NVD CVE-2026-73313
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.