Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

FriendsOfFlarum OAuth lets attacker hijack accounts via Discord

CVE-2026-92161 · published 14 days ago
Summary

The FriendsOfFlarum OAuth plugin for Flarum (versions before 1.7.4 and 2.0.0‑beta.4) does not verify that a Discord‑provided email address is confirmed. An attacker who knows a user's email can create a Discord account with that same unverified email, log in, and be treated as the legitimate user without a password. Upgrade the plugin to the latest version to close the gap and require proper email verification.

What to do
  • Update fof oauth to version 1.7.4.
  • Update fof oauth to version 2.0.0-beta.4.
  • Update fof fof/oauth to version 1.7.4.
  • Update fof fof/oauth to version 2.0.0-beta.4.
Affected software
Ecosystem VendorProductAffected versions
– friendsofflarum oauth < 1.7.4
composer fof oauth < 1.7.4
>= 2.0.0-beta.1, < 2.0.0-beta.4
Fix: upgrade to 1.7.4
Packagist fof fof/oauth < 1.7.4
>= 2.0.0-beta.1, < 2.0.0-beta.4
Fix: upgrade to 1.7.4
Original advisory text
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail(). When Discord sign-in is enabled, an unauthenticated attacker who knows the email address of a Flarum user can configure a Discord account with that unverified address and a verified phone number, then sign in to cause Flarum to match the trusted address, link the attacker-controlled Discord identity to the existing user, and authenticate as the victim without a password or victim interaction. Exploitation requires that the victim's email address is not already associated with a Discord account, and it can compromise administrator accounts. Other bundled providers were not confirmed to be practically exploitable by this method because their relevant authentication flows return only verified or confirmed email addresses. This issue is fixed in versions 1.7.4 and 2.0.0-beta.4.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published25 Sep 2026
Updated9 Oct 2026
First seen25 Sep 2026
Sources
CVE-2026-92161 · NVD
CVE-2026-92161 · MITRE
GHSA-g7vj-c29h-3h5m · GHSA
CVE-2026-92161 · OSV
GHSA-g7vj-c29h-3h5m · OSV
Track software like this
Free during beta