CVE-2026-92161 in OAuth
Summary
by MITRE • 09/25/2026
FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail(). When Discord sign-in is enabled, an unauthenticated attacker who knows the email address of a Flarum user can configure a Discord account with that unverified address and a verified phone number, then sign in to cause Flarum to match the trusted address, link the attacker-controlled Discord identity to the existing user, and authenticate as the victim without a password or victim interaction. Exploitation requires that the victim's email address is not already associated with a Discord account, and it can compromise administrator accounts. Other bundled providers were not confirmed to be practically exploitable by this method because their relevant authentication flows return only verified or confirmed email addresses. This issue is fixed in versions 1.7.4 and 2.0.0-beta.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The FriendsOfFlarum OAuth extension facilitates user authentication for the Flarum forum software by integrating with external identity providers such as GitHub, Twitter, Facebook, and Discord. This functionality allows users to log in using their existing credentials from these third-party services rather than maintaining separate passwords within the Flarum application. While this enhances usability, it introduces specific security considerations regarding how email addresses are validated and trusted during the authentication handshake. The vulnerability identified affects versions prior to 1.7.4 for stable releases and prior to 2.0.0-beta.4 for beta releases, specifically concerning the Discord OAuth provider implementation.
The core technical flaw lies in the handling of the verified status of an email address returned by the Discord API during the OAuth flow. When a user initiates login via Discord, the extension retrieves profile data including the primary email address and its verification status from Discord. In vulnerable versions, the code fails to inspect the verified field associated with this email before passing it to Flarum core through the provideTrustedEmail() method. This function is designed to mark an email as trusted, bypassing standard email confirmation requirements within Flarum. By accepting unverified emails as trusted without validation, the extension creates a trust boundary violation where external identity assertions are treated with higher authority than intended by the application's security model.
An attacker can exploit this flaw through account takeover if they know the target victim's email address and that it is not already associated with an active Discord account. The exploitation process involves the attacker creating or configuring a new Discord account using the victim's unverified email address, ensuring that the account also has a verified phone number to satisfy Discord's basic security requirements for account creation. Once this configuration is complete, the attacker initiates a login attempt via Discord OAuth on the Flarum instance. The vulnerable extension receives the email from Discord, sees it matches an existing user in the database, and because it does not check if that specific email was verified by Discord at the time of authentication, it links the attacker's Discord identity to the victim's account. Consequently, the attacker gains full access to the victim's Flarum account without needing a password or any interaction from the victim.
The operational impact of this vulnerability is severe as it allows for unauthenticated remote code execution in terms of user privileges. Since the attack does not require prior authentication on the target system, it can be executed by any external actor with knowledge of an email address. The risk is particularly acute if the targeted account holds administrative privileges within Flarum, as gaining control over such accounts could allow the attacker to modify forum settings, access sensitive user data, or install malicious extensions that compromise the entire platform infrastructure. Although other bundled providers like GitHub and Facebook were analyzed, they were not confirmed to be practically exploitable via this specific method because their authentication flows typically return only verified or confirmed email addresses by default, thereby mitigating the risk of accepting unverified identities as trusted sources.
This vulnerability is categorized under CWE-287 Improper Authentication, specifically relating to misinterpretation of input and insufficient verification of identity attributes. It also aligns with MITRE ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials or linked accounts to gain unauthorized access. The root cause stems from a failure in the principle of least privilege regarding trust delegation; the application should only accept email addresses as trusted if they have been explicitly verified by the identity provider at the moment of authentication. To mitigate this issue, users must upgrade the FriendsOfFlarum OAuth extension to version 1.7.4 or later for stable branches and 2.0.0-beta.4 or later for beta branches. These updated versions implement proper checks on the email verification status before trusting it within Flarum core. Administrators should also consider implementing additional monitoring for unusual login patterns from new OAuth providers to detect potential exploitation attempts in environments where upgrading is not immediately feasible.