CVE-2023-46241 Potential account take over due to unverified emails from Microsoft Identity Platform

discourse-microsoft-auth is a plugin that enables authentication via Microsoft. On sites with the discourse-microsoft-auth plugin enabled, an attack can potentially take control of a victim's Discourse account. Sites that have configured their application's account type to any options other than...

CVE-2023-46241

The CVE-2023-46241 entry concerns the discourse-microsoft-auth plugin for Discourse, which allows Microsoft-based authentication and can enable account takeovers when sites are configured to non-single-tenant accounts. The issue is linked to authentication handling within the plugin and has been ...