CVE-2026-92161
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled.
- No known exploitation
- Severity
- Critical, CVSS 9.8 (v3.1)
- EPSS
- 0.27% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- fof/oauth (composer) < 1.7.4, fixed in 1.7.4 · GHSA-g7vj-c29h-3h5m
- fof/oauth (composer) >= 2.0.0-beta.1, < 2.0.0-beta.4, fixed in 2.0.0-beta.4 · GHSA-g7vj-c29h-3h5m