CVE-2026-32113

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the enter action in StaticController reads the sso_destination_url cookie and redirects to it with allow_other_host: true without validating the destination URL. While this cookie is normally set during legitimate DiscourseConnect Provider flows with cryptographically validated SSO payloads, cookies are client-controlled and can be set by attackers. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

• CWE-601

• https://github.com/discourse/discourse/commit/080408b93d00305b51d71f63f755f43fa601884dPatch
• https://github.com/discourse/discourse/security/advisories/GHSA-378j-ccw4-4fwhMitigation, Vendor Advisory
• https://meta.discourse.org/t/using-discourse-as-a-sso-provider/32974Product
• https://meta.discourse.org/t/use-discourse-as-an-identity-provider-sso-discourseconnect/32974Product

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32108Copyparty is a portable file server. Prior to 1.20.12, there…6.5
• CVE-2026-32109Copyparty is a portable file server. Prior to 1.20.12, if an…4.4
• CVE-2026-3211Cross-Site Request Forgery (CSRF) vulnerability in Drupal Th…4.3
• CVE-2026-32110SiYuan is a personal knowledge management system. Prior to 3…8.3
• CVE-2026-32111ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…5.3
• CVE-2026-32112ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…4.7
• CVE-2026-32114Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2026-32116Magic Wormhole makes it possible to get arbitrary-sized file…8.1
• CVE-2026-32117The grafanacubism-panel plugin allows use of cubism.js in Gr…5.4
• CVE-2026-32118OpenEMR is a free and open source electronic health records …9
• CVE-2026-32119OpenEMR is a free and open source electronic health records …4.4
• CVE-2026-3212Improper Neutralization of Input During Web Page Generation …5.4