Critical Flarum OAuth Flaw Allows Unauthenticated Account Takeover

A critical vulnerability in the FriendsOfFlarum OAuth extension for the Flarum forum platform could let an unauthenticated attacker take over user accounts, including administrator accounts. The flaw is rated 9.8 out of 10, in the highest severity band.

The issue, tracked as CVE-2026-92161, affects forums that enabled the Discord sign-in provider in the fof/oauth extension. In that configuration, the extension trusted an email address supplied during Discord sign-in without confirming that Discord had verified it. Discord permits an account to carry an unverified email address in some circumstances, so an attacker could present a victim's email address and be signed in as that user.

The fix is available in fof/oauth 1.7.4 and in 2.0.0-beta.4. Forum operators running the extension with Discord sign-in enabled should update immediately and review recent account activity for unexpected sign-ins. Forums that do not use the Discord provider are not affected by this specific flaw.

Source: GitHub Security Advisories