- Affected version
- 2.2.8 Patch 1
There appears to be some sort of edge case when opening a thread which can result in bizarre redirection behaviour on the 2FA token expiring and prompting for a token.
Resulting in this;
https://xenforo.com/community/login/two-step?_xfRedirect=https%3A%2F%2Fxenforo.com%2Fcommunity%2Flogin%2Ftwo-step%3F_xfRedirect%3Dhttps%253A%252F%252Fxenforo.com%252Fcommunity%252Flogin%252Ftwo-step%253F_xfRedirect%253Dhttps%25253A%25252F%25252Fxenforo.com%25252Fcommunity%25252Flogin%25252Ftwo-step%25253F_xfRedirect%25253Dhttps%2525253A%2525252F%2525252Fxenforo.com%2525252Fcommunity%2525252Flogin%2525252Ftwo-step%2525253F_xfRedirect%2525253Dhttps%252525253A%252525252F%252525252Fxenforo.com%252525252Fcommunity%252525252Flogin%252525252Ftwo-step%252525253F_xfRedirect%252525253Dhttps%25252525253A%25252525252F%25252525252Fxenforo.com%25252525252Fcommunity%25252525252Flogin%25252525252Ftwo-step%25252525253F_xfRedirect%25252525253Dhttps%2525252525253A%2525252525252F%2525252525252Fxenforo.com%2525252525252Fcommunity%2525252525252Flogin%2525252525252Ftwo-step%2525252525253F_xfRedirect%2525252525253Dhttps%252525252525253A%252525252525252F%252525252525252Fxenforo.com%252525252525252Fcommunity%252525252525252Flogin%252525252525252Ftwo-step%252525252525253F_xfRedirect%252525252525253Dhttps%25252525252525253A%25252525252525252F%25252525252525252Fxenforo.com%25252525252525252Fcommunity%25252525252525252Flogin%25252525252525252Ftwo-step%25252525252525253F_xfRedirect%25252525252525253Dhttps%2525252525252525253A%2525252525252525252F%2525252525252525252Fxenforo.com%2525252525252525252Fcommunity%2525252525252525252Flogin%2525252525252525252Ftwo-step%2525252525252525253F_xfRedirect%2525252525252525253Dhttps%252525252525252525253A%252525252525252525252F%252525252525252525252Fxenforo.com%252525252525252525252Fcommunity%252525252525252525252Flogin%252525252525252525252Ftwo-step%252525252525252525253F_xfRedirect%252525252525252525253Dhttps%25252525252525252525253A%25252525252525252525252F%25252525252525252525252Fxenforo.com%25252525252525252525252Fcommunity%25252525252525252525252Flogin%25252525252525252525252Ftwo-step%25252525252525252525253F_xfRedirect%25252525252525252525253Dhttps%2525252525252525252525253A%2525252525252525252525252F%2525252525252525252525252Fxenforo.com%2525252525252525252525252Fcommunity%2525252525252525252525252Flogin%2525252525252525252525252Ftwo-step%2525252525252525252525253F_xfRedirect%2525252525252525252525253Dhttps%252525252525252525252525253A%252525252525252525252525252F%252525252525252525252525252Fxenforo.com%252525252525252525252525252Fcommunity%252525252525252525252525252Flogin%252525252525252525252525252Ftwo-step%252525252525252525252525253F_xfRedirect%252525252525252525252525253Dhttps%25252525252525252525252525253A%25252525252525252525252525252F%25252525252525252525252525252Fxenforo.com%25252525252525252525252525252Fcommunity%25252525252525252525252525252Flogin%25252525252525252525252525252Ftwo-step%25252525252525252525252525253F_xfRedirect%25252525252525252525252525253Dhttps%2525252525252525252525252525253A%2525252525252525252525252525252F%2525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252Fcommunity%2525252525252525252525252525252Flogin%2525252525252525252525252525252Ftwo-step%2525252525252525252525252525253F_xfRedirect%2525252525252525252525252525253Dhttps%252525252525252525252525252525253A%252525252525252525252525252525252F%252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252Fcommunity%252525252525252525252525252525252Flogin%252525252525252525252525252525252Ftwo-step%252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525253Dhttps%25252525252525252525252525252525253A%25252525252525252525252525252525252F%25252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252Flogin%25252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525253Dhttps%2525252525252525252525252525252525253A%2525252525252525252525252525252525252F%2525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252Flogin%2525252525252525252525252525252525252Ftwo-step%2525252525252525252525252525252525253F_xfRedirect%2525252525252525252525252525252525253Dhttps%252525252525252525252525252525252525253A%252525252525252525252525252525252525252F%252525252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252525252Fcommunity%252525252525252525252525252525252525252Flogin%252525252525252525252525252525252525252Ftwo-step%252525252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525252525253Dhttps%25252525252525252525252525252525252525253A%25252525252525252525252525252525252525252F%25252525252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252525252Flogin%25252525252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525252525253Dhttps%2525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252525252Flogin%2525252525252525252525252525252525252525252Ftwo-step%2525252525252525252525252525252525252525253F_xfRedirect%2525252525252525252525252525252525252525253Dhttps%252525252525252525252525252525252525252525253A%252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252525252525252Fcommunity%252525252525252525252525252525252525252525252Flogin%252525252525252525252525252525252525252525252Ftwo-step%252525252525252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525252525252525253Dhttps%25252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252525252525252Flogin%25252525252525252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525252525252525253Dhttps%2525252525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252525252525252Flogin%2525252525252525252525252525252525252525252525252Ftwo-step%2525252525252525252525252525252525252525252525253F_xfRedirect%2525252525252525252525252525252525252525252525253Dhttps%252525252525252525252525252525252525252525252525253A%252525252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252525252525252525252Fcommunity%252525252525252525252525252525252525252525252525252Flogin%252525252525252525252525252525252525252525252525252Ftwo-step%252525252525252525252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525252525252525252525253Dhttps%25252525252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252525252525252525252Flogin%25252525252525252525252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525252525252525252525253Dhttps%2525252525252525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252525252525252525252Fthreads%2525252525252525252525252525252525252525252525252525252Fcompatibility-for-csrf-protection-cloudflare-full-html-page-caching.202315%2525252525252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252525252526remember%25252525252525252525252525252525252525252525252525253D1%2525252525252525252525252525252525252525252525252526remember%252525252525252525252525252525252525252525252525253D1%25252525252525252525252525252525252525252525252526remember%2525252525252525252525252525252525252525252525253D1%252525252525252525252525252525252525252525252526remember%25252525252525252525252525252525252525252525253D1%2525252525252525252525252525252525252525252526remember%252525252525252525252525252525252525252525253D1%25252525252525252525252525252525252525252526remember%2525252525252525252525252525252525252525253D1%252525252525252525252525252525252525252526remember%25252525252525252525252525252525252525253D1%2525252525252525252525252525252525252526remember%252525252525252525252525252525252525253D1%25252525252525252525252525252525252526remember%2525252525252525252525252525252525253D1%252525252525252525252525252525252526remember%25252525252525252525252525252525253D1%2525252525252525252525252525252526remember%252525252525252525252525252525253D1%25252525252525252525252525252526remember%2525252525252525252525252525253D1%252525252525252525252525252526remember%25252525252525252525252525253D1%2525252525252525252525252526remember%252525252525252525252525253D1%25252525252525252525252526remember%2525252525252525252525253D1%252525252525252525252526remember%25252525252525252525253D1%2525252525252525252526remember%252525252525252525253D1%25252525252525252526remember%2525252525252525253D1%252525252525252526remember%25252525252525253D1%2525252525252526remember%252525252525253D1%25252525252526remember%2525252525253D1%252525252526remember%25252525253D1%2525252526remember%252525253D1%25252526remember%2525253D1%252526remember%25253D1%2526remember%253D1%26remember%3D1&remember=1
The original URL that I tried opening was https://xenforo.com/community/threads/compatibility-for-csrf-protection-cloudflare-full-html-page-caching.202315/
Resulting in this;
https://xenforo.com/community/login/two-step?_xfRedirect=https%3A%2F%2Fxenforo.com%2Fcommunity%2Flogin%2Ftwo-step%3F_xfRedirect%3Dhttps%253A%252F%252Fxenforo.com%252Fcommunity%252Flogin%252Ftwo-step%253F_xfRedirect%253Dhttps%25253A%25252F%25252Fxenforo.com%25252Fcommunity%25252Flogin%25252Ftwo-step%25253F_xfRedirect%25253Dhttps%2525253A%2525252F%2525252Fxenforo.com%2525252Fcommunity%2525252Flogin%2525252Ftwo-step%2525253F_xfRedirect%2525253Dhttps%252525253A%252525252F%252525252Fxenforo.com%252525252Fcommunity%252525252Flogin%252525252Ftwo-step%252525253F_xfRedirect%252525253Dhttps%25252525253A%25252525252F%25252525252Fxenforo.com%25252525252Fcommunity%25252525252Flogin%25252525252Ftwo-step%25252525253F_xfRedirect%25252525253Dhttps%2525252525253A%2525252525252F%2525252525252Fxenforo.com%2525252525252Fcommunity%2525252525252Flogin%2525252525252Ftwo-step%2525252525253F_xfRedirect%2525252525253Dhttps%252525252525253A%252525252525252F%252525252525252Fxenforo.com%252525252525252Fcommunity%252525252525252Flogin%252525252525252Ftwo-step%252525252525253F_xfRedirect%252525252525253Dhttps%25252525252525253A%25252525252525252F%25252525252525252Fxenforo.com%25252525252525252Fcommunity%25252525252525252Flogin%25252525252525252Ftwo-step%25252525252525253F_xfRedirect%25252525252525253Dhttps%2525252525252525253A%2525252525252525252F%2525252525252525252Fxenforo.com%2525252525252525252Fcommunity%2525252525252525252Flogin%2525252525252525252Ftwo-step%2525252525252525253F_xfRedirect%2525252525252525253Dhttps%252525252525252525253A%252525252525252525252F%252525252525252525252Fxenforo.com%252525252525252525252Fcommunity%252525252525252525252Flogin%252525252525252525252Ftwo-step%252525252525252525253F_xfRedirect%252525252525252525253Dhttps%25252525252525252525253A%25252525252525252525252F%25252525252525252525252Fxenforo.com%25252525252525252525252Fcommunity%25252525252525252525252Flogin%25252525252525252525252Ftwo-step%25252525252525252525253F_xfRedirect%25252525252525252525253Dhttps%2525252525252525252525253A%2525252525252525252525252F%2525252525252525252525252Fxenforo.com%2525252525252525252525252Fcommunity%2525252525252525252525252Flogin%2525252525252525252525252Ftwo-step%2525252525252525252525253F_xfRedirect%2525252525252525252525253Dhttps%252525252525252525252525253A%252525252525252525252525252F%252525252525252525252525252Fxenforo.com%252525252525252525252525252Fcommunity%252525252525252525252525252Flogin%252525252525252525252525252Ftwo-step%252525252525252525252525253F_xfRedirect%252525252525252525252525253Dhttps%25252525252525252525252525253A%25252525252525252525252525252F%25252525252525252525252525252Fxenforo.com%25252525252525252525252525252Fcommunity%25252525252525252525252525252Flogin%25252525252525252525252525252Ftwo-step%25252525252525252525252525253F_xfRedirect%25252525252525252525252525253Dhttps%2525252525252525252525252525253A%2525252525252525252525252525252F%2525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252Fcommunity%2525252525252525252525252525252Flogin%2525252525252525252525252525252Ftwo-step%2525252525252525252525252525253F_xfRedirect%2525252525252525252525252525253Dhttps%252525252525252525252525252525253A%252525252525252525252525252525252F%252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252Fcommunity%252525252525252525252525252525252Flogin%252525252525252525252525252525252Ftwo-step%252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525253Dhttps%25252525252525252525252525252525253A%25252525252525252525252525252525252F%25252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252Flogin%25252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525253Dhttps%2525252525252525252525252525252525253A%2525252525252525252525252525252525252F%2525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252Flogin%2525252525252525252525252525252525252Ftwo-step%2525252525252525252525252525252525253F_xfRedirect%2525252525252525252525252525252525253Dhttps%252525252525252525252525252525252525253A%252525252525252525252525252525252525252F%252525252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252525252Fcommunity%252525252525252525252525252525252525252Flogin%252525252525252525252525252525252525252Ftwo-step%252525252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525252525253Dhttps%25252525252525252525252525252525252525253A%25252525252525252525252525252525252525252F%25252525252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252525252Flogin%25252525252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525252525253Dhttps%2525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252525252Flogin%2525252525252525252525252525252525252525252Ftwo-step%2525252525252525252525252525252525252525253F_xfRedirect%2525252525252525252525252525252525252525253Dhttps%252525252525252525252525252525252525252525253A%252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252525252525252Fcommunity%252525252525252525252525252525252525252525252Flogin%252525252525252525252525252525252525252525252Ftwo-step%252525252525252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525252525252525253Dhttps%25252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252525252525252Flogin%25252525252525252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525252525252525253Dhttps%2525252525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252525252525252Flogin%2525252525252525252525252525252525252525252525252Ftwo-step%2525252525252525252525252525252525252525252525253F_xfRedirect%2525252525252525252525252525252525252525252525253Dhttps%252525252525252525252525252525252525252525252525253A%252525252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252525252Fxenforo.com%252525252525252525252525252525252525252525252525252Fcommunity%252525252525252525252525252525252525252525252525252Flogin%252525252525252525252525252525252525252525252525252Ftwo-step%252525252525252525252525252525252525252525252525253F_xfRedirect%252525252525252525252525252525252525252525252525253Dhttps%25252525252525252525252525252525252525252525252525253A%25252525252525252525252525252525252525252525252525252F%25252525252525252525252525252525252525252525252525252Fxenforo.com%25252525252525252525252525252525252525252525252525252Fcommunity%25252525252525252525252525252525252525252525252525252Flogin%25252525252525252525252525252525252525252525252525252Ftwo-step%25252525252525252525252525252525252525252525252525253F_xfRedirect%25252525252525252525252525252525252525252525252525253Dhttps%2525252525252525252525252525252525252525252525252525253A%2525252525252525252525252525252525252525252525252525252F%2525252525252525252525252525252525252525252525252525252Fxenforo.com%2525252525252525252525252525252525252525252525252525252Fcommunity%2525252525252525252525252525252525252525252525252525252Fthreads%2525252525252525252525252525252525252525252525252525252Fcompatibility-for-csrf-protection-cloudflare-full-html-page-caching.202315%2525252525252525252525252525252525252525252525252525252F%252525252525252525252525252525252525252525252525252526remember%25252525252525252525252525252525252525252525252525253D1%2525252525252525252525252525252525252525252525252526remember%252525252525252525252525252525252525252525252525253D1%25252525252525252525252525252525252525252525252526remember%2525252525252525252525252525252525252525252525253D1%252525252525252525252525252525252525252525252526remember%25252525252525252525252525252525252525252525253D1%2525252525252525252525252525252525252525252526remember%252525252525252525252525252525252525252525253D1%25252525252525252525252525252525252525252526remember%2525252525252525252525252525252525252525253D1%252525252525252525252525252525252525252526remember%25252525252525252525252525252525252525253D1%2525252525252525252525252525252525252526remember%252525252525252525252525252525252525253D1%25252525252525252525252525252525252526remember%2525252525252525252525252525252525253D1%252525252525252525252525252525252526remember%25252525252525252525252525252525253D1%2525252525252525252525252525252526remember%252525252525252525252525252525253D1%25252525252525252525252525252526remember%2525252525252525252525252525253D1%252525252525252525252525252526remember%25252525252525252525252525253D1%2525252525252525252525252526remember%252525252525252525252525253D1%25252525252525252525252526remember%2525252525252525252525253D1%252525252525252525252526remember%25252525252525252525253D1%2525252525252525252526remember%252525252525252525253D1%25252525252525252526remember%2525252525252525253D1%252525252525252526remember%25252525252525253D1%2525252525252526remember%252525252525253D1%25252525252526remember%2525252525253D1%252525252526remember%25252525253D1%2525252526remember%252525253D1%25252526remember%2525253D1%252526remember%25253D1%2526remember%253D1%26remember%3D1&remember=1
The original URL that I tried opening was https://xenforo.com/community/threads/compatibility-for-csrf-protection-cloudflare-full-html-page-caching.202315/