Loading vulnerability…
Passkey Authentication Security Bypass in XenForo before 2.3.7
CVE-2025-71279 is a security issue in XenForo versions prior to 2.3.7 affecting Passkeys that have been added to user accounts. The available information indicates that the flaw can compromise the security of passkey-based authentication, implying that the authentication mechanism for registered passkeys does not correctly enforce or validate authentication requirements in some circumstances. Publicly provided details are limited, and no specific vulnerable function or code path is identified in the supplied content. The issue is classified as CWE-287, indicating improper authentication.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may allow an attacker to compromise passkey-based authentication for affected XenForo accounts. Given the supplied CVSS assessment and description, the likely impact includes unauthorized account access and the ability to act as the affected user. Depending on the privileges of the compromised account, this could expose sensitive forum data, permit unauthorized administrative or moderation actions, alter content or configuration, and potentially disrupt service integrity and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling Passkey-based authentication until the update can be applied, especially for privileged accounts. Require alternative MFA methods for administrator and moderator accounts, monitor authentication logs for anomalous passkey-related logins, and review account activity for signs of unauthorized access. Because the available information does not provide a vendor-endorsed workaround, mitigation should be treated as temporary and incomplete pending upgrade to 2.3.7 or later.
Patch, then assume compromise.
Upgrade XenForo to version 2.3.7 or later, as XenForo 2.3.7 is identified as including the security fixes for this issue. Apply the vendor-provided update across all affected installations and ensure that all application files and related components are fully updated. After patching, review accounts using Passkeys and consider revalidating or re-enrolling passkeys for sensitive or administrative accounts if recommended by the vendor or internal policy.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.