CVE-2025-71278

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
XenForo	XenForo	>= 2.3.0, < 2.3.5

References

https://www.vulncheck.com/advisories/xenforo-oauth2-unauthorized-scope-requestThird Party Advisory
https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812/Release Notes

Timeline

Published: Apr 1, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-712799.8XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromi CVE-2025-71289.8A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown cod CVE-2025-712805.5XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share a CVE-2025-712819.8XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter CVE-2025-712827.5XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker t CVE-2025-712849.8Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.CVE-2025-712855.5In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels MHI st CVE-2025-712865.5In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Correct the allocation size for bytes control CVE-2025-712875.5In the Linux kernel, the following vulnerability has been resolved: memory: mtk-smi: fix device leak on larb probe Make sure to drop the r CVE-2025-712885.5In the Linux kernel, the following vulnerability has been resolved: memory: mtk-smi: fix device leaks on common probe Make sure to drop th CVE-2025-712895.5In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle attr_set_size() errors when truncating files If attr_CVE-2025-71299.8A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing