Executive brief
A critical vulnerability in the FriendsOfFlarum OAuth extension allows attackers to take over any Flarum forum user account if Discord sign-in is enabled, without needing the victim's password or any interaction from them. An attacker only needs to know a user's email address and can register a Discord account using that unverified email, then authenticate to the forum as that user—including administrator accounts.
Technical details
The vulnerability exists in the fof/oauth extension's Discord OAuth provider integration. Discord allows accounts to use unverified email addresses if a phone number is verified, and returns such addresses with `"verified": false` in the OAuth response. The vulnerable extension failed to check this verification flag and instead passed the unverified email directly to Flarum core's `provideTrustedEmail()` method, which trusts the email as legitimate. Flarum then matches this trusted email to existing accounts and links the attacker's Discord identity to the victim's account, enabling authentication as that user. This is a network-accessible, unauthenticated attack requiring only knowledge of the victim's email address. Patches are available in versions 1.7.4 and 2.0.0-beta.4.
Affected products
- FriendsOfFlarum OAuth before 1.7.4, before 2.0.0-beta.4
Timeline
- 2026-09-25: disclosed