fof/oauth
Allow users to log in with GitHub, Twitter, Facebook, and more!
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 56
- Cadence
- ~12 days
- Last 12 months
- 10
Reach
- Stars
- 54
Details
- License
- MIT
- First release
- Oct 08, 2020
| Version | Released | |
|---|---|---|
2.0.1
patch
|
2.0.1
patch
Dependencies (6)
Changelog
Compare changes
|
|
2.0.0
major
|
2.0.0
major
Dependencies (6)
Changelog
Compare changes
|
|
2.0.0-rc.1
pre
|
2.0.0-rc.1
pre
Dependencies (6)
Changelog
Compare changes
|
|
1.8.0
minor
|
1.8.0
minor
Dependencies (8)
Changelog
Compare changes
|
|
2.0.0-beta.4
pre
|
2.0.0-beta.4
pre
Dependencies (6)
Changelog
Compare changes
|
|
1.7.4
patch
|
1.7.4
patch
Dependencies (8)
Changelog
Compare changes
|
|
2.0.0-beta.3
pre
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
2.0.0-beta.3
pre
Dependencies (6)
Changelog
Compare changes
|
|
2.0.0-beta.2
pre
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
2.0.0-beta.1
pre
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
2.0.0-beta.1
pre
Dependencies (8)
Changelog
Compare changes
|
|
1.7.3
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.7.3
patch
Dependencies (8)
Changelog
Compare changes
|
|
1.7.2
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.7.2
patch
Dependencies (8)
Changelog
Compare changes
|
|
1.7.1
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.7.0
minor
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.16
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.14
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.13
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.12
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.11
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.10
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.9
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.8
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.7
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.6
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.6.6
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.6.5
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.4
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.3
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.6.3
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.6.2
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.6.1
minor
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.5.4
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.5.4
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.5.3
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.5.3
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.5.2
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.5.1
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.5.0
minor
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.4.4
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.4.4
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.4.3
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.4.3
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.4.2
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.4.2
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.4.1
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.4.1
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.4.0
minor
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.3.2
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.3.2
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.3.1
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.3.0
minor
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.2.5
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.2.5
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.2.4
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.2.3
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.2.2
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.2.1
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.2.0
minor
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.1.1
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |
1.1.1
patch
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
1.1.0
minor
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
1.0.2
patch
1 CVE
CVE-2026-92161
GHSA-g7vj-c29h-3h5m
Sep 25, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
ImpactAn unauthenticated account takeover vulnerability exists in Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with Affected versions of An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. Preconditions for exploitation
The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched VersionsWorkaroundsAdministrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. CreditsReported by @faran1512 Affected versions
0.1.0
0.2.0
0.2.1
0.3.0
1.0.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
+ 38 more Show less
1.2.3
1.2.4
1.2.5
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.16
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
Fixed in
1.7.4
2.0.0-beta.4
References
Updated Sep 25, 2026 · Source: OSV.dev |