CVE-2026-92161

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail(). When Discord sign-in is enabled, an unauthenticated attacker who knows the email address of a Flarum user can configure a Discord account with that unverified address and a verified phone number, then sign in to cause Flarum to match the trusted address, link the attacker-controlled Discord identity to the existing user, and authenticate as the victim without a password or victim interaction. Exploitation requires that the victim's email address is not already associated with a Discord account, and it can compromise administrator accounts. Other bundled providers were not confirmed to be practically exploitable by this method because their relevant authentication flows return only verified or confirmed email addresses. This issue is fixed in versions 1.7.4 and 2.0.0-beta.4.

• CWE-345

• https://github.com/FriendsOfFlarum/oauth/commit/baca3466b3b7be51c70a7e0ba966901aefeb344a
• https://github.com/FriendsOfFlarum/oauth/commit/bb4bf376832e6bb68c579715d2a4b5a92c4a2567
• https://github.com/FriendsOfFlarum/oauth/releases/tag/1.7.4
• https://github.com/FriendsOfFlarum/oauth/releases/tag/2.0.0-beta.4
• https://github.com/FriendsOfFlarum/oauth/security/advisories/GHSA-g7vj-c29h-3h5m

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92139Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and ear…6.5
• CVE-2026-9214Insufficient input validation vulnerability in the NETGEAR R…4.5
• CVE-2026-92140Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not…6.8
• CVE-2026-92141Jenkins Keycloak Authentication Plugin 2.4.1 and earlier doe…4.3
• CVE-2026-9215A cross site request forgery (CSRF) vulnerability in the lis…6.7
• CVE-2026-9216An insufficient input validation vulnerability in the listed…3.5
• CVE-2026-92164Streamlink is a CLI utility which pipes video streams from v…6.5
• CVE-2026-92176pdfforge PDF Architect App Object Out-Of-Bounds Read Remote …7.8
• CVE-2026-92177pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write …7.8
• CVE-2026-92178pdfforge PDF Architect PDF File Parsing Memory Corruption Re…7.8
• CVE-2026-92179pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write …7.8
• CVE-2026-92180pdfforge PDF Architect activation-service Update Service Unc…7.8