PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92161 FriendsOfFlarum CVE debrief

CVE-2026-92161 is a critical vulnerability in the FriendsOfFlarum OAuth plugin for Flarum, allowing unauthenticated attackers to link their Discord identity to an existing user's account and authenticate as the victim without a password or interaction. This issue arises from the plugin's failure to verify the email address returned by the Discord OAuth provider before passing it to Flarum core as trusted. The vulnerability impacts Flarum users with Discord sign-in enabled and can compromise administrator accounts. Exploitation requires that the victim's email address is not already associated with a Discord account. The issue is fixed in versions 1.7.4 and 2.0.0-beta.4.

Vendor
FriendsOfFlarum
Product
oauth
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-25
Original CVE updated
2026-09-25
Advisory published
2026-09-25
Advisory updated
2026-09-25

Who should care

Flarum administrators and users with Discord sign-in enabled should assess exposure and update to version 1.7.4 or 2.0.0-beta.4. Administrators should verify email address verification for other OAuth providers and monitor for suspicious login activity. Flarum users with Discord sign-in enabled should update to version 1.7.4 or 2.0.0-beta.4 and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-92161 is a critical vulnerability in the FriendsOfFlarum OAuth plugin for Flarum, allowing unauthenticated attackers to link their Discord identity to an existing user's account and authenticate as the victim without a password or interaction. Flarum administrators and users with Discord sign-in enabled should assess exposure and update to version 1.7.4 or 2.0.0-beta.4.

  • Unauthenticated attackers can bypass authentication and gain access to user accounts
  • Administrators should verify email address verification for other OAuth providers
  • Flarum users with Discord sign-in enabled should update to version 1.7.4 or 2.0.0-beta.4

Technical summary

The FriendsOfFlarum OAuth plugin for Flarum does not properly verify email addresses returned by the Discord OAuth provider, allowing an attacker to link their Discord identity to an existing user's account and authenticate as the victim without a password or interaction. This vulnerability exists because the plugin does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail(). The issue can be mitigated by updating to version 1.7.4 or 2.0.0-beta.4, verifying email address verification for other OAuth providers, and monitoring for suspicious login activity.

Defensive priority

High priority for Flarum administrators and users with Discord sign-in enabled

Recommended defensive actions

  • Update to version 1.7.4 or 2.0.0-beta.4
  • Verify email address verification for other OAuth providers
  • Monitor for suspicious login activity
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the Discord OAuth provider of the FriendsOfFlarum OAuth plugin, which does not verify the email address returned by Discord before passing it to Flarum core as trusted. This allows an attacker to configure a Discord account with an unverified email address and a verified phone number, then sign in to Flarum as the victim.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92161 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92161

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92161 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92161

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.