CVE-2026-73313

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths.

• CWE-863

• https://bombobombone.github.io/posts/cve-2026-73313/Exploit, Third Party Advisory
• https://github.com/BomboBombone/CVE-2026-73313Exploit, Third Party Advisory
• https://www.vulncheck.com/advisories/xenforo-mfa-bypass-via-passkey-tfa-providerThird Party Advisory
• https://xenforo.com/community/threads/security-fixes-released-for-all-xenforo-and-media-gallery-versions-2-2-0-2-3-12.239856/Release Notes
• https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/Release Notes

Published

Sep 8, 2026

Last Modified

Sep 14, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73307Budibase is an open-source low-code platform. Prior to 3.39.…4.9
• CVE-2026-73308Budibase is an open-source low-code platform. Prior to 3.39.…5.7
• CVE-2026-73309XenForo before 2.3.13 contains an authentication bypass vuln…9.1
• CVE-2026-73310XenForo before 2.3.13 contains an authorization flaw in the …5.9
• CVE-2026-73311XenForo before 2.3.13 contains an OAuth2 authorization code …7.4
• CVE-2026-73312XenForo before 2.3.13 contains a refresh token replay vulner…7.4
• CVE-2026-73314XenForo before 2.3.13 contains a signature verification logi…7.5
• CVE-2026-73315XenForo before 2.3.13 contains a server-side request forgery…8.6
• CVE-2026-73316XenForo before 2.3.13 contains a payment replay vulnerabilit…7.5
• CVE-2026-73317XenForo before 2.3.13 contains a missing authorization vulne…2.7
• CVE-2026-73318XenForo before 2.3.13 contains a missing authorization vulne…3.8
• CVE-2026-73319XenForo before 2.3.13 contains a cross-site scripting vulner…6.1