Skip to content
OpenAdvisories

Package · Packagist

fof/oauth

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.8
    CVE-2026-92161

    FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

    FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to…

    FriendsOfFlarum oauth fof/oauth Packagist