{"uuid": "45cd3d27-6928-4d3f-8056-430dd5c8d0c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-g7vj-c29h-3h5m", "type": "seen", "source": "https://gist.github.com/alon710/ce948372dcaedff5ad40dfc5f894ab79", "content": "# CVE-2026-92161: CVE-2026-92161: Unauthenticated Account Takeover in FriendsOfFlarum OAuth Extension\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92161\n\n## Summary\nA critical logical vulnerability in the FriendsOfFlarum OAuth (fof/oauth) extension allows unauthenticated remote attackers to perform complete account takeover, including administrative profiles. This vulnerability is caused by a failure to verify the email verification status returned by third-party identity providers such as Discord before asserting that the email is trusted and matching it to existing local accounts.\n\n## TL;DR\nUnauthenticated remote account takeover via unverified identity provider email trust violation (CVE-2026-92161).\n\n## Technical Details\n\n- **CWE ID**: CWE-345\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8\n- **EPSS Score**: 0.00\n- **Impact**: Critical (Confidentiality, Integrity, Availability)\n- **Exploit Status**: None (PoC concepts documented)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- FriendsOfFlarum OAuth Extension (fof/oauth)\n\n## Mitigation\n\n- Upgrade FriendsOfFlarum OAuth extension to 1.7.4 or 2.0.0-beta.4\n- Disable affected third-party login providers (Discord, GitLab, Google, LinkedIn) temporarily if an immediate upgrade is not possible\n\n**Remediation Steps:**\n1. Identify the current installed version of fof/oauth.\n2. Run 'composer update fof/oauth:1.7.4' for Flarum 1.x or 'composer update fof/oauth:2.0.0-beta.4' for Flarum 2.x.\n3. Clear Flarum's cache using 'php flarum cache:clear'.\n4. Confirm that the patched code is applied by inspecting providers for conditional verification checks.\n\n## References\n\n- [GitHub Security Advisory GHSA-g7vj-c29h-3h5m](https://github.com/FriendsOfFlarum/oauth/security/advisories/GHSA-g7vj-c29h-3h5m)\n- [Official CVE.org Record for CVE-2026-92161](https://www.cve.org/CVERecord?id=CVE-2026-92161)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92161) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T16:30:32.000000Z"}