PT-2026-29414 · Xenforo · Xenforo

CVE-2025-71278 · Published 2026-04-01 · Updated 2026-04-01

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.5

Description XenForo before version 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.

Recommendations Update to version 2.3.5 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-71278

Affected Products

Xenforo

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-71278 · Security Note
• https://twitter.com/CVEarity/status/2039257124782637281 · Twitter Post
• https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812 · Vendor Advisory, Patch
• https://vulncheck.com/advisories/xenforo-oauth2-unauthorized-scope-request · Note
• https://twitter.com/CveFindCom/status/2039156478313906299 · Twitter Post
• https://twitter.com/CVEnew/status/2039279706684768765 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039160921868919173 · Twitter Post