OAuth Provider Vulnerability in Flarum by FriendsOfFlarum

CVE-2026-92161

What is CVE-2026-92161?

A vulnerability exists in the Flarum OAuth extension that allows unauthenticated attackers to exploit the Discord sign-in functionality. If the attacker's Discord account is configured with an unverified email address matching that of a legitimate Flarum user, they can bypass usual authentication mechanisms and impersonate the user, leading to unauthorized access to their account. This includes potential access to administrator privileges, depending on the user's role within the Flarum community. Fixes for this issue have been implemented in versions 1.7.4 and 2.0.0-beta.4.

References