FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

Critical · CVSS 9.8

### Impact An unauthenticated account takeover vulnerability exists in `fof/oauth` when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with `"verified": false`. Affected versions of `fof/oauth` did not validate this flag and passed the email address to Flarum core as trusted via `provideTrustedEmail()`.

Remediation

Upgrade fof/oauth to 1.7.4 or later. Upgrade fof/oauth to 2.0.0-beta.4 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-g7vj-c29h-3h5m

← All threats