PT-2026-29414 · Xenforo · Xenforo

Published 2026-04-01 · Updated 2026-04-01 · CVE-2025-71278

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-71278

Affected Products

Xenforo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-71278 · Security Note
• https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812 · Vendor Advisory
• https://vulncheck.com/advisories/xenforo-oauth2-unauthorized-scope-request · Note