FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

Impact An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with...

GHSA-G7VJ-C29H-3H5M FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

Impact An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the provideTrustedEmail process. An attacker can gain unauthorized access to user accounts, including administrator accounts, by leveraging Discord OAuth to associate an unverified email...

CVE-2026-92161 FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

CVE-2026-92161

The FriendsOfFlarum OAuth extension (prior to versions 1.7.4 and 2.0.0-beta.4 ) contains an unauthenticated account takeover vulnerability when the Discord OAuth provider is enabled. The root cause is that the extension fails to check the verified field for emails returned by Discord, instead pas...

CVE-2026-92161 FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

CVE-2026-92161 FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

EUVD-2026-87140

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

CVE-2026-92288

A flaw was found in lemonldap-ng. The OAuth 2.0 Open Authorization token introspection endpoint fails to properly verify client credentials when handling requests for public relying parties. A remote attacker possessing an access token and a public client identifier can exploit this vulnerability...

PT-2026-98925

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.18 RabbitMQ versions 4.0.x through 4.0.23 RabbitMQ versions 4.1.x through 4.1.14 RabbitMQ versions 4.2.x through 4.2.9 RabbitMQ versions 4.3.x through 4.3.4 Description An issue exists where OAuth credenti...

PT-2026-98894

Name of the Vulnerable Software and Affected Versions FriendsOfFlarum OAuth versions prior to 1.7.4 FriendsOfFlarum OAuth versions prior to 2.0.0-beta.4 Description An account takeover issue exists when the Discord OAuth provider is enabled. The provider fails to check the verified field of the...

Linux Distros Unpatched Vulnerability : CVE-2026-67421

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP...

CVE-2026-92161: Insufficient Verification of Data Authenticity

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through...

Mattermost Server 11.7.x < 11.7.11 / 11.8.x < 11.8.6 / 11.9.x < 11.9.2 / 11.10.x < 11.10.2 Multiple Vulnerabilities (MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776 advisories. - Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a...

Linux Distros Unpatched Vulnerability : CVE-2026-57177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the...

F5 Networks BIG-IP : BIG-IP APM vulnerability (K000162605)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.5.0.41.14 / 17.5.1.9.0.160.12 / 21.1.0.2.0.30.22. It is, therefore, affected by a vulnerability as referenced in the K000162605 advisory. When a BIG-IP APM access policy and an OAuth profile are configured on a...

CVE-2026-56734: Server-Side Request Forgery (SSRF)

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

Linux Distros Unpatched Vulnerability : CVE-2026-67237

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or...

CVE-2026-93354

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...

EUVD-2026-86453

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no...