CVE-2026-92161

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail(). When Discord sign-in is enabled, an unauthenticated attacker who knows the email address of a Flarum user can configure a Discord account with that unverified address and a verified phone number, then sign in to cause Flarum to match the trusted address, link the attacker-controlled Discord identity to the existing user, and authenticate as the victim without a password or victim interaction. Exploitation requires that the victim's email address is not already associated with a Discord account, and it can compromise administrator accounts. Other bundled providers were not confirmed to be practically exploitable by this method because their relevant authentication flows return only verified or confirmed email addresses. This issue is fixed in versions 1.7.4 and 2.0.0-beta.4.

• CWE-345

• https://github.com/FriendsOfFlarum/oauth/commit/baca3466b3b7be51c70a7e0ba966901aefeb344a
• https://github.com/FriendsOfFlarum/oauth/commit/bb4bf376832e6bb68c579715d2a4b5a92c4a2567
• https://github.com/FriendsOfFlarum/oauth/releases/tag/1.7.4
• https://github.com/FriendsOfFlarum/oauth/releases/tag/2.0.0-beta.4
• https://github.com/FriendsOfFlarum/oauth/security/advisories/GHSA-g7vj-c29h-3h5m

Published

Sep 25, 2026

Last Modified

Sep 30, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92156F´ (F Prime) is a framework that enables development and dep…6.5
• CVE-2026-92157F´ (F Prime) is a framework that enables development and dep…6.5
• CVE-2026-92158F´ (F Prime) is a framework that enables development and dep…7.2
• CVE-2026-92159F´ (F Prime) is a framework that enables development and dep…6.5
• CVE-2026-9216An insufficient input validation vulnerability in the listed…3.5
• CVE-2026-92160F´ (F Prime) is a framework that enables development and dep…6.5
• CVE-2026-92162Flatpak is a system for building, distributing, and running …7.2
• CVE-2026-92164Streamlink is a CLI utility which pipes video streams from v…6.5
• CVE-2026-92171A flaw was found in the Infinispan Operator for Red Hat Data…6.5
• CVE-2026-92172Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService…8.8
• CVE-2026-92173Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobRe…9.1
• CVE-2026-92174The SiteOrigin Widgets Bundle plugin for WordPress is vulner…7.5