EUVD-2026-87140
GHSA-g7vj-c29h-3h5m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated takeover with no user interaction (AV:N/AC:L/PR:N/UI:N); full account/admin compromise yields C:H/I:H, and admin control supports A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
7DescriptionCVE.org
FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail(). When Discord sign-in is enabled, an unauthenticated attacker who knows the email address of a Flarum user can configure a Discord account with that unverified address and a verified phone number, then sign in to cause Flarum to match the trusted address, link the attacker-controlled Discord identity to the existing user, and authenticate as the victim without a password or victim interaction. Exploitation requires that the victim's email address is not already associated with a Discord account, and it can compromise administrator accounts. Other bundled providers were not confirmed to be practically exploitable by this method because their relevant authentication flows return only verified or confirmed email addresses. This issue is fixed in versions 1.7.4 and 2.0.0-beta.4.
Articles & Coverage 1
AnalysisAI
Unauthenticated account takeover in the FriendsOfFlarum OAuth extension (fof/oauth) for Flarum, affecting versions prior to 1.7.4 and 2.0.0-beta.4 when the Discord sign-in provider is enabled. Attackers who know a target user's email address can register a Discord account with that address left unverified (relying on a verified phone number to satisfy Discord) and then sign in, causing the extension to hand the address to Flarum core as trusted and link the attacker-controlled Discord identity to the victim's existing account - including administrator accounts - with no password and no victim interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Discord OAuth provider is enabled in the fof/oauth extension settings on the target Flarum forum (not necessarily a default configuration). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-priority vulnerability where the CVSS 9.8 rating is largely defensible, not inflated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 1.7.4 for the 1.x line and 2.0.0-beta.4 for the 2.0 beta line - upgrade to the appropriate fixed version via Composer (composer require fof/oauth:^1.7.4 or the corresponding 2.0.0-beta.4 constraint) and confirm the extension is updated in the Flarum admin panel. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Flarum instance running fof/oauth and identify those with the Discord sign-in provider enabled; on any confirmed instance, disable the Discord provider as an immediate risk-reduction step, and audit recent login and account-linking events for Discord identities attached to pre-existing accounts, prioritizing administrator accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today