CVE-2023-40588

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user could add a 2FA or security key with a carefully crafted name to their account and cause a denial of service for other users. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds.

• CWE-770

• https://github.com/discourse/discourse/security/advisories/GHSA-2hg5-3xm3-9vvxThird Party Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-2hg5-3xm3-9vvxThird Party Advisory

Published

Sep 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40582find-exec is a utility to discover available shell commands.…9.8
• CVE-2023-40583libp2p is a networking stack and library modularized out of …7.5
• CVE-2023-40584Argo CD is a declarative continuous deployment for Kubernete…6.5
• CVE-2023-40585ironic-image is a container image to run OpenStack Ironic as…7.5
• CVE-2023-40586OWASP Coraza WAF is a golang modsecurity compatible web appl…7.5
• CVE-2023-40587Pyramid is an open source Python web framework. A path trave…5.3
• CVE-2023-40589FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2023-4059The Profile Builder WordPress plugin before 3.9.8 lacks auth…4.3
• CVE-2023-40590 GitPython is a python library used to interact with Git rep…7.8
• CVE-2023-40591go-ethereum (geth) is a golang execution layer implementatio…7.5
• CVE-2023-40592In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12…6.1
• CVE-2023-40593In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a…7.5