Libdave
Monthly
Discord libdave before 1.2.0 can accept an unauthorized participant into an end-to-end encrypted media session because it does not reject an MLS Welcome message whose group roster contains an unrecognized user ID. An attacker who controls the DAVE signaling path, such as a malicious or compromised Discord voice gateway or an equivalent position able to add, alter, or withhold MLS signaling, can exploit this to compromise the confidentiality and integrity of voice and video content; no client authentication or user interaction is required, but the signaling-path requirement raises the practical bar. A vendor patch is available in libdave 1.2.0, and no public exploit code was identified at time of analysis.
Discord libdave before 1.2.0 can accept an unauthorized participant into an end-to-end encrypted media session because it does not reject an MLS Welcome message whose group roster contains an unrecognized user ID. An attacker who controls the DAVE signaling path, such as a malicious or compromised Discord voice gateway or an equivalent position able to add, alter, or withhold MLS signaling, can exploit this to compromise the confidentiality and integrity of voice and video content; no client authentication or user interaction is required, but the signaling-path requirement raises the practical bar. A vendor patch is available in libdave 1.2.0, and no public exploit code was identified at time of analysis.