Invisibility Bypass in Discord Client
CVE-2026-24332

4.3MEDIUM

Key Information:

Vendor

Discord

Status
Websocket Api Service
Vendor
CVE Published:
22 January 2026

What is CVE-2026-24332?

A vulnerability in the Discord Client allows an attacker to infer a user's 'Invisible' status through the WebSocket API. This occurs because the API response includes users marked as 'offline' in the presences array, which can lead to confusion about actual user visibility. Although the UI indicates that users with an 'Invisible' status appear offline, this inconsistency may result in unauthorized access to a user's client state, thus compromising their privacy and security.

Affected Version(s)

WebSocket API service 0 <= 2026-01-16

References

https://xmrcat.org/discord-invisibility-bypass

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.