Unauthenticated Account Takeover in FriendsOfFlarum OAuth via Discord Login (CVE-2026-92161)

What happened

The fof/oauth package's Discord OAuth provider failed to check whether an email address returned by Discord was actually verified before passing it to Flarum core as a trusted email via the provideTrustedEmail() function. Because Discord allows an account to have an unverified email paired with a verified phone number, an attacker could register a Discord account using a victim's known email address without ever verifying it, and still have that email accepted as trusted by Flarum.

Technical cause

The root cause is classified as CWE-345, Insufficient Verification of Data Authenticity. The Discord provider in fof/oauth did not inspect the 'verified' field that Discord's API returns alongside the email address. Other bundled OAuth providers in the package were not confirmed to be practically exploitable this way, since their respective authentication flows only return email addresses that are already verified or confirmed.

Why it matters

By signing in with a Discord account configured with an unverified copy of a victim's email address, an attacker can cause Flarum to link that Discord identity to the victim's existing forum account. This grants the attacker authenticated access as the victim, with no password required and no action needed from the victim. The advisory notes this can be used to compromise administrator accounts, which could lead to full control over a Flarum forum.

Who is affected

Any Flarum installation that uses the fof/oauth package with the Discord sign-in provider enabled is potentially affected. Exploitation requires that the victim's email address is not already linked to a Discord account; if it is, the attack cannot be carried out against that account.

Affected versions

The vulnerability affects fof/oauth versions prior to 1.7.4, as well as the 2.0.0 beta line starting at 2.0.0-beta.1 up to (but not including) 2.0.0-beta.4.

Fixes and mitigation

The issue is fixed in fof/oauth versions 1.7.4 and 2.0.0-beta.4. Sites running an affected version should upgrade to one of these fixed releases.

Recommended action

Update fof/oauth to version 1.7.4 if running the 1.x line, or to 2.0.0-beta.4 if running the 2.0.0 beta line, as soon as possible. If an immediate update is not possible, consider disabling the Discord login provider until the upgrade is applied.