CVE-2026-92161: Unauthenticated Account Takeover in FriendsOfFlarum OAuth Extension
Vulnerability ID: CVE-2026-92161
CVSS Score: 9.8
Published: 2026-09-25
A critical logical vulnerability in the FriendsOfFlarum OAuth (fof/oauth) extension allows unauthenticated remote attackers to perform complete account takeover, including administrative profiles. This vulnerability is caused by a failure to verify the email verification status returned by third-party identity providers such as Discord before asserting that the email is trusted and matching it to existing local accounts.
TL;DR
Unauthenticated remote account takeover via unverified identity provider email trust violation (CVE-2026-92161).
Technical Details
- CWE ID: CWE-345
- Attack Vector: Network (AV:N)
- CVSS Score: 9.8
- EPSS Score: 0.00
- Impact: Critical (Confidentiality, Integrity, Availability)
- Exploit Status: None (PoC concepts documented)
- CISA KEV Status: Not Listed
Affected Systems
- FriendsOfFlarum OAuth Extension (fof/oauth)
Mitigation Strategies
- Upgrade FriendsOfFlarum OAuth extension to 1.7.4 or 2.0.0-beta.4
- Disable affected third-party login providers (Discord, GitLab, Google, LinkedIn) temporarily if an immediate upgrade is not possible
Remediation Steps:
- Identify the current installed version of fof/oauth.
- Run 'composer update fof/oauth:1.7.4' for Flarum 1.x or 'composer update fof/oauth:2.0.0-beta.4' for Flarum 2.x.
- Clear Flarum's cache using 'php flarum cache:clear'.
- Confirm that the patched code is applied by inspecting providers for conditional verification checks.
References
Read the full report for CVE-2026-92161 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)