Discourse EUVD-2025-28274

This is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability specific to Discourse's social login authentication handlers. The root cause appears to be insufficient input sanitization or output encoding in the social login callback/processing endpoints when CSP is not active to provide a secondary XSS defense. Discourse (CPE identifier: cpe:2.3:a:discourse:discourse) is a Ruby on Rails-based discussion platform; the vulnerability likely exists in the OmniAuth integration layer or social provider callback handlers that process untrusted user input from OAuth providers or redirect parameters without proper encoding. The vulnerability is context-dependent on CSP being disabled, indicating that Discourse intentionally relies on CSP as a primary XSS mitigation in production deployments. Affected versions: Discourse < 3.5.0.beta6.