Description
XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of Passkey-based authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| XenForo | XenForo | 2.3.0 – < 2.3.7 | 2.3.7 |
References
- XenForo 2.3.7 Released (Includes Security Fixes) vendor-advisory patch
- VulnCheck Advisory: XenForo Passkey Security Bypass third-party-advisory