Is CVE-2026-73312 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73312?

CVE-2026-73312 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-73312

Description

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.