Is CVE-2026-92161 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92161 being exploited in the wild.

How severe is CVE-2026-92161?

Critical severity, with a CVSS score of 9.8, published 25 September 2026.

Which products and versions are affected?

fof/oauth (Packagist) ECOSYSTEM:introduced=0,fixed=1.7.4.

Is there a fix for CVE-2026-92161?

Yes. fof/oauth (Packagist): upgrade to 1.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92161 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-92161?

Check whether you run fof/oauth (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92161: FriendsOfFlarum OAuth account takeover via unverified Discord email

CVE-2026-92161 · Severity: critical · CVSS 9.8 · Published 2026-09-25

A critical vulnerability in the FriendsOfFlarum OAuth extension allows attackers to take over any Flarum forum user account if Discord sign-in is enabled, without needing the victim's password or any interaction from them. An attacker only needs to know a user's email address and can register a Discord account using that unverified email, then authenticate to the forum as that user—including administrator accounts.

Vendors: Packagist.

Quick answers

Is CVE-2026-92161 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92161 being exploited in the wild.
How severe is CVE-2026-92161?: Critical severity, with a CVSS score of 9.8, published 25 September 2026.
Which products and versions are affected?: fof/oauth (Packagist) ECOSYSTEM:introduced=0,fixed=1.7.4.
Is there a fix for CVE-2026-92161?: Yes. fof/oauth (Packagist): upgrade to 1.7.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92161 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-92161?: Check whether you run fof/oauth (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fof/oauth (Packagist): upgrade to 1.7.4 or later
```
composer require fof/oauth:^1.7.4
```

Technical details

The vulnerability exists in the fof/oauth extension's Discord OAuth provider integration. Discord allows accounts to use unverified email addresses if a phone number is verified, and returns such addresses with `"verified": false` in the OAuth response. The vulnerable extension failed to check this verification flag and instead passed the unverified email directly to Flarum core's `provideTrustedEmail()` method, which trusts the email as legitimate. Flarum then matches this trusted email to existing accounts and links the attacker's Discord identity to the victim's account, enabling authentication as that user. This is a network-accessible, unauthenticated attack requiring only knowledge of the victim's email address. Patches are available in versions 1.7.4 and 2.0.0-beta.4.

Affected products

FriendsOfFlarum OAuth before 1.7.4, before 2.0.0-beta.4

Identifiers

CVE-2026-92161
GHSA-g7vj-c29h-3h5m

Timeline

2026-09-25: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.