Discourse EUVD-2026-17546

The CVSS 4.0 score of 5.1 reflects moderate risk with nuanced attack characteristics. The vector AV:N (network attack vector) and PR:N (no privileges required) indicate broad accessibility, but AC:H (high complexity) and AT:P (passive threat) suggest attackers must either social engineer users into clicking links or exploit persistent cookie mechanisms-not trivial attack execution. The impact ratings (VC:N/VI:N/VA:N/SC:H/SI:H/SA:N) indicate limited direct confidentiality/integrity/availability impact on the Discourse system itself, but significant scope changes and secondary impacts to users (SI:H suggests high session/authentication impacts for victims). This is a phishing/credential harvesting vector rather than system compromise. The EPSS score is not provided, but the combination of high attack vector accessibility, user interaction requirement, and cookie-based delivery suggests lower real-world exploitation probability than the CVSS score alone implies. No KEV confirmation, no public exploit code, and no active exploitation reports lower the practical threat level. Organizations running affected versions should prioritize patching, but this is not a critical incident-response priority. The open redirect tag correctly categorizes the flaw-exploitation chains this with credential theft rather than direct system access.

An attacker crafts a malicious link containing or leveraging cookie-injection techniques to set the sso_destination_url cookie to a phishing site (e.g., attacker.com/fake-discourse-login). When a legitimate Discourse user clicks the link, the StaticController enter action reads the attacker-controlled cookie and redirects the user to the phishing site without validation. The victim is presented with a credential harvesting page mimicking the Discourse login interface, leading to credential theft. Alternatively, the attacker could use HTTP response splitting or other cookie-injection vectors in multi-tenant environments to poison the cookie in cached responses. Exploitation requires user interaction (clicking a crafted link) but succeeds due to the lack of URL validation, making it suitable for targeted phishing campaigns against Discourse administrators or power users.