PT-2025-33751 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.5.0.beta8 Description: Discourse, an open-source discussion platform, contains a cross-site scripting XSS issue in the welcome banner user name string for logged-in users. This can affect the user or an...

Discourse cross-site scripting vulnerabilities

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from a cross-site scripting attack in which an unescaped username string is...

CVE-2025-54411: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcomebanner.header.loggedinmembers site text to remove the...

Malicious code in discourse-steam-login (npm)

The package discourse-steam-login was found to contain malicious code...

MAL-2025-18491 Malicious code in discourse-logster-rate-limit-checker (npm)

The package discourse-logster-rate-limit-checker was found to contain malicious code...

Malicious code in discourse-whos-online (npm)

The package discourse-whos-online was found to contain malicious code...

Malicious code in discourse-logster-rate-limit-checker (npm)

The package discourse-logster-rate-limit-checker was found to contain malicious code...

MAL-2025-18493 Malicious code in discourse-whos-online (npm)

The package discourse-whos-online was found to contain malicious code...

MAL-2025-18492 Malicious code in discourse-steam-login (npm)

The package discourse-steam-login was found to contain malicious code...

Discourse < 3.4.7 Improper Authentication Vulnerability

Discourse is prone to an improper authentication vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-53102

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared...

BIT-DISCOURSE-2025-53102 Discourse's WebAuthn challenge isn't cleared from user session after authentication

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared...

CVE-2025-53102

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared...

CVE-2025-53102

CVE-2025-53102 affects Discourse: prior to 3.4.7 (stable) and 3.5.0.beta.8 (tests-passed), issuing a physical security key for 2FA generates a WebAuthn challenge that is not cleared from the user session after authentication, potentially allowing reuse and increasing security risk. Affected versi...

CVE-2025-53102 Discourse's WebAuthn challenge isn't cleared from user session after authentication

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared...

CVE-2025-53102 Discourse's WebAuthn challenge isn't cleared from user session after authentication

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared...

CVE-2025-53102 Discourse's WebAuthn challenge isn't cleared from user session after authentication

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared...

Discourse authorization issue vulnerabilities

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email, and chat rooms. An authorization issue vulnerability exists in Discourse versions prior to 3.4.7 and prior to 3.5.0.beta.8, which stems from an uncleare...

CVE-2025-53102: Session Fixation

Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the stable branch and version 3.5.0.beta.8 on the tests-passed branch, upon issuing a physical security key for 2FA, the server generates a WebAuthn challenge, which the client signs. The challenge is not cleared...

PT-2025-31259 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.4.7 on the stable branch Discourse versions prior to 3.5.0.beta.8 on the tests-passed branch Description: Discourse is an open-source community discussion platform. Upon issuing a physical security key for...