Loading vulnerability…
Unauthorized OAuth2 Scope Request in XenForo before 2.3.5
CVE-2025-71278 is an authorization flaw in XenForo 2.3 prior to 2.3.5 affecting OAuth2 client applications. According to the provided content, vulnerable XenForo versions allow OAuth2 clients to request scopes they should not be permitted to obtain. As a result, the authorization process can grant client applications access beyond their intended authorization level. The issue affects customers using OAuth2 clients on any XenForo 2.3 release before 2.3.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an OAuth2 client application with low-privilege access to obtain unauthorized scopes and thereby gain access to resources or capabilities beyond those intended by the authorization model. Based on the provided CVSS vectors and description, this may result in significant confidentiality, integrity, and availability impact depending on what protected actions or data are exposed through the improperly granted scopes.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, limit or disable use of OAuth2 client applications where feasible, restrict registration and approval of OAuth2 clients to trusted applications only, and review authorization policies and issued tokens for excessive scopes. Monitor for OAuth2 clients requesting or using scopes beyond their expected role until the platform can be updated. Specific vendor-provided workaround details are not available in the provided content.
Patch, then assume compromise.
Upgrade XenForo to version 2.3.5 or later, as the provided content states that XenForo 2.3.5 includes the security fix for this issue. Review existing OAuth2 client configurations and granted scopes to ensure no client has retained excessive permissions that were improperly obtainable prior to the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.