Listen to this Post
An unauthenticated account takeover vulnerability exists in the fof/oauth extension for Flarum when the Discord OAuth provider is enabled. Discord permits an account to use an unverified email address if the account has a verified phone number. During the OAuth authentication flow, Discord may return that email address with the “verified” field set to false. Affected versions of fof/oauth did not validate this flag and passed the email address to Flarum core as trusted via the provideTrustedEmail() method. Flarum core could then match the trusted email address to an existing user, link the attacker-controlled Discord identity to that user, and authenticate the attacker as the victim. An attacker who knows a user’s email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts. The preconditions for exploitation are: Discord sign-in is enabled on the forum; the victim has a Flarum account with a known email address; the victim’s email address is not already associated with a Discord account; the attacker creates or configures a Discord account using the victim’s email address without verifying it and verifies a phone number instead; and the attacker authenticates to the forum using that Discord account. The issue is specific to Discord’s ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow. Patched versions are 1.7.4 and 2.0.0-beta.4. Administrators who cannot update immediately should disable the Discord OAuth provider in the extension settings. This vulnerability is tracked as CVE-2026-92161 and is categorized under CWE-287 Improper Authentication. The root cause stems from a failure to verify the email verification status before trusting it within Flarum core. To mitigate this issue, users must upgrade the FriendsOfFlarum OAuth extension to version 1.7.4 or later for stable branches and 2.0.0-beta.4 or later for beta branches. These updated versions implement proper checks on the email verification status before trusting it within Flarum core. Administrators should also consider implementing additional monitoring for unusual login patterns from new OAuth providers to detect potential exploitation attempts in environments where upgrading is not immediately feasible. The operational impact of this vulnerability is severe as it allows for unauthenticated remote code execution in terms of user privileges. Since the attack does not require prior authentication on the target system, it can be executed by any external actor with knowledge of an email address. The risk is particularly acute if the targeted account holds administrative privileges within Flarum, as gaining control over such accounts could allow the attacker to modify forum settings, access sensitive user data, or install malicious extensions that compromise the entire platform infrastructure.
DailyCVE Form:
Platform: Flarum
Version: <1.7.4, <2.0.0-beta.4
Vulnerability: Account takeover
Severity: High
date: 2026-09-25
Prediction: 2026-10-25
What Undercode Say:
Check current fof/oauth version composer show fof/oauth Verify Discord OAuth is enabled in Flarum admin php flarum info | grep -i discord Test OAuth callback endpoint (educational) curl -X GET "https://forum.example.com/auth/discord" -I Simulate Discord OAuth token exchange (educational) curl -X POST "https://discord.com/api/oauth2/token" \ -d "client_id=YOUR_CLIENT_ID" \ -d "client_secret=YOUR_CLIENT_SECRET" \ -d "grant_type=authorization_code" \ -d "code=AUTHORIZATION_CODE" \ -d "redirect_uri=YOUR_REDIRECT_URI" Check email verification flag in Discord API response curl -X GET "https://discord.com/api/users/@me" \ -H "Authorization: Bearer ACCESS_TOKEN" | jq '.verified'
How Exploit: (Educational Purposes!)
Step 1: Attacker creates Discord account with victim's email (unverified) and verified phone Step 2: Attacker initiates OAuth flow on target Flarum forum Step 3: fof/oauth passes unverified email to Flarum core as trusted Step 4: Flarum matches email to existing user and links Discord identity Step 5: Attacker is authenticated as victim
Protection: from this CVE
Upgrade fof/oauth to patched version composer require fof/oauth:^1.7.4 For beta branch composer require fof/oauth:^2.0.0-beta.4 Disable Discord OAuth provider if patch cannot be applied immediately In Flarum admin panel: Extensions > FriendsOfFlarum OAuth > Discord > Disable
Impact:
Unauthenticated attacker can take over any Flarum account including administrator accounts No password or victim interaction required Attacker gains full access to victim's account Potential for forum settings modification, data access, and malicious extension installation
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
