XenForo before version 2.3.7 has a vulnerability that allows an attacker to bypass Passkey authentication. The weakness is an authentication flaw that can be exploited to assume the identity of any user with a Passkey configured, compromising account integrity and potentially granting full user privileges.

The vulnerability affects all XenForo releases prior to 2.3.7. Users running any earlier version should upgrade to 2.3.7 or later to eliminate the flaw.

The CVSS score of 9.3 indicates critical severity and the vulnerability is not listed in the KEV catalog. EPSS data is unavailable, but the lack of known exploits does not reduce the risk. The likely attack vector is through the web interface that processes Passkey authentication requests; an attacker can supply forged Passkey data remotely to coerce the system into authenticating them as a legitimate user. This flaw can be exploited without requiring local access or user interaction.