Is CVE-2026-53963 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53963 being exploited in the wild.

How severe is CVE-2026-53963?

High severity, with a CVSS score of 7.3, published 9 July 2026.

Which products and versions are affected?

Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0.

Is there a fix for CVE-2026-53963?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-53963 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-53963?

Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53963: Discourse stored XSS in 2FA delete confirmation dialog

Q: Which products and versions are affected?

Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0.

Q: Is there a fix for CVE-2026-53963?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-53963 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-53963?

Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53963 · Severity: high · CVSS 7.3 · Published 2026-07-09

Discourse is an open-source platform used for hosting online discussion forums and communities. A security vulnerability exists where a malicious user can name their two-factor authentication (2FA) method with a script that executes when an administrator attempts to manage or delete that user's account. If successful, this could allow an attacker to hijack administrative sessions, potentially leading to unauthorized access to sensitive community data or full control over the forum.

Technologies: Discourse. Vendors: Discourse.

Quick answers

Is CVE-2026-53963 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53963 being exploited in the wild.
How severe is CVE-2026-53963?: High severity, with a CVSS score of 7.3, published 9 July 2026.
Which products and versions are affected?: Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0.
Is there a fix for CVE-2026-53963?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-53963 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-53963?: Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Discourse due to improper neutralization of input in the two-factor authentication (2FA) management interface. Specifically, the name assigned to a second-factor authentication method was not properly escaped when displayed within the delete confirmation dialog. An attacker with a low-privileged account can set a malicious payload as their 2FA device name. The vulnerability is triggered when an administrator impersonates the attacker's account and interacts with the 2FA deletion modal. This could lead to the execution of arbitrary JavaScript in the context of the administrator's session. The issue is resolved in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Affected products

Discourse Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0

Timeline

2026-07-09: advisory: GitHub Security Advisory published
2026-07-09: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.