CVE-2025-71279 - Vulnerability Analysis

Overview

XenForo < 2.3.7 contains a broken authentication vulnerability caused by a security issue affecting Passkeys in user accounts, letting attackers compromise Passkey-based authentication, exploit requires no special conditions.

Severity & Score

Impact

Attackers can compromise Passkey-based authentication, potentially gaining unauthorized access to user accounts.

Mitigation

Update to version 2.3.7 or later.

References

• https://xenforo.com/community/threads/xenforo-2-3-7-released-includes-security-fixes.232121/
• https://www.vulncheck.com/advisories/xenforo-passkey-security-bypass

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner