CVE-2026-104480 Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client...

CVE-2026-104480

Discord libdave versions before 1.2.0 are vulnerable to a flaw where the system fails to reject an MLS Welcome message if the resulting group roster contains an unrecognized participant. An attacker capable of controlling the DAVE signaling path (such as a voice gateway) can manipulate signaling ...

PT-2026-104066

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client...