PT-2026-29415 · Xenforo · Xenforo

Hypixel Inc · Published 2026-04-01 · Updated 2026-04-01 · CVE-2025-71279

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XenForo versions prior to 2.3.7

Description XenForo versions prior to 2.3.7 have a security issue affecting Passkeys added to user accounts. An attacker may be able to compromise the security of Passkey-based authentication.

Recommendations Update XenForo to version 2.3.7 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-71279

Affected Products

Xenforo

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-71279 · Security Note
• https://vulncheck.com/advisories/xenforo-passkey-security-bypass · Note
• https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121 · Vendor Advisory, Patch
• https://twitter.com/0dayPublishing/status/2039148084823830817 · Twitter Post
• https://twitter.com/cybrsecpath/status/2039182594919874734 · Twitter Post
• https://twitter.com/CveFindCom/status/2039156508215140538 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039166753989927240 · Twitter Post
• https://twitter.com/CVEnew/status/2039279705577431540 · Twitter Post
• https://twitter.com/CVEarity/status/2039259903882379618 · Twitter Post