CVE-2025-71278 - Vulnerability Analysis

Overview

XenForo < 2.3.5 contains a broken access control caused by OAuth2 client applications requesting unauthorized scopes, letting attackers gain access beyond intended authorization, exploit requires OAuth2 client usage.

Severity & Score

Impact

OAuth2 clients can gain unauthorized access beyond their intended scopes, potentially compromising user data and permissions.

Mitigation

Upgrade to version 2.3.5 or later.

References

• https://www.vulncheck.com/advisories/xenforo-oauth2-unauthorized-scope-request
• https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner