Unauthenticated Account Takeover in FriendsOfFlarum OAuth via Discord Provider

The FriendsOfFlarum fof/oauth extension (CVE-2026-92161) contains a critical vulnerability that allows unauthenticated account takeover. When the Discord OAuth provider is enabled, the extension fails to verify the verified flag returned by the Discord API. Discord may return an email address as unverified if the account's associated phone number has been validated, even if the email itself has not been confirmed.

The fof/oauth extension incorrectly treats these unverified emails as trusted, passing them to the Flarum core provideTrustedEmail() function. If the provided email address matches an existing user on the forum, Flarum automatically links the attacker-controlled Discord identity to that account and logs the attacker in as the victim. This enables complete account takeover, including administrative accounts, provided the attacker knows the victim's email address. The vulnerability affects version series 1.x before 1.7.4 and 2.0.0-beta versions before 2.0.0-beta.4.

Attack Chain

1. Attacker identifies a target Flarum forum that has the Discord OAuth provider enabled.
2. Attacker obtains the target victim's email address, which is associated with a Flarum account.
3. Attacker creates or configures a Discord account using the victim's email address as the primary account email.
4. Attacker verifies a phone number on the Discord account, which allows the email address to remain in an unverified state within the Discord ecosystem.
5. Attacker initiates an OAuth authentication flow via the targeted Flarum forum using the compromised Discord account.
6. The fof/oauth extension receives the OAuth callback from Discord, including the victim's email address marked with "verified": false.
7. The extension fails to validate the "verified": false flag and calls provideTrustedEmail() with the target's email.
8. Flarum core identifies the victim's account via the email address and completes the authentication, granting the attacker full access to the victim's session.

Impact

The vulnerability allows for complete account takeover, including administrative accounts, without requiring user interaction or knowledge of the user's password. Any forum utilizing the fof/oauth extension with the Discord provider enabled is susceptible. The extent of the damage is dependent on the level of privilege held by the targeted accounts on the affected forums.

Recommendation

1. Upgrade the fof/oauth extension to version 1.7.4 or 2.0.0-beta.4 or later immediately.
2. If an immediate upgrade is not feasible, disable the Discord OAuth provider in the Flarum extension settings to mitigate the risk of exploitation.
3. Audit user sessions and account linking logs for signs of suspicious OAuth association activity.