https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 26 Sep 2026 15:00:17 +0000 https://vulnerability.circl.lu/sighting/bfa0cece-08ce-44ef-8240-cefceed38a59/export {"uuid": "bfa0cece-08ce-44ef-8240-cefceed38a59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgipni7a22q", "content": "CVE-2026-92161 - oauth\nThe FriendsOfFlarum OAuth extension for Flarum (versions before 1.7.4 and 2.0.0\u2011beta.4) trusts email addresses from Discord without confirming they are verified. An attacker who\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#oauth #fof #composer #CVE #infosec", "creation_timestamp": "2026-09-26T14:30:05.322609Z"} {"uuid": "bfa0cece-08ce-44ef-8240-cefceed38a59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgipni7a22q", "content": "CVE-2026-92161 - oauth\nThe FriendsOfFlarum OAuth extension for Flarum (versions before 1.7.4 and 2.0.0\u2011beta.4) trusts email addresses from Discord without confirming they are verified. An attacker who\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#oauth #fof #composer #CVE #infosec", "creation_timestamp": "2026-09-26T14:30:05.322609Z"} https://vulnerability.circl.lu/sighting/bfa0cece-08ce-44ef-8240-cefceed38a59/export Sat, 26 Sep 2026 14:30:05 +0000 https://vulnerability.circl.lu/sighting/30d8795b-aa01-4679-89f8-501975aa5c9b/export {"uuid": "30d8795b-aa01-4679-89f8-501975aa5c9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfuncic6i2k", "content": "\ud83d\udd34 CVE-2026-92161 - Critical (9.8)\n\nFriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-92161/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T08:30:52.375263Z"} {"uuid": "30d8795b-aa01-4679-89f8-501975aa5c9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfuncic6i2k", "content": "\ud83d\udd34 CVE-2026-92161 - Critical (9.8)\n\nFriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-92161/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T08:30:52.375263Z"} https://vulnerability.circl.lu/sighting/30d8795b-aa01-4679-89f8-501975aa5c9b/export Sat, 26 Sep 2026 08:30:52 +0000 https://vulnerability.circl.lu/sighting/b1d6cf3b-b87c-4c36-bef7-295d1c2667eb/export {"uuid": "b1d6cf3b-b87c-4c36-bef7-295d1c2667eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mweegahdcz2r", "content": "\ud83d\udea8 CVE-2026-92161 \u2014 CVSS 9.8 CRITICAL\n\nFriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92161\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T18:07:54.765608Z"} {"uuid": "b1d6cf3b-b87c-4c36-bef7-295d1c2667eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mweegahdcz2r", "content": "\ud83d\udea8 CVE-2026-92161 \u2014 CVSS 9.8 CRITICAL\n\nFriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92161\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T18:07:54.765608Z"} https://vulnerability.circl.lu/sighting/b1d6cf3b-b87c-4c36-bef7-295d1c2667eb/export Fri, 25 Sep 2026 18:07:54 +0000 https://vulnerability.circl.lu/sighting/862e4eb7-5680-4cf2-9ca6-91ca2954f9e6/export {"uuid": "862e4eb7-5680-4cf2-9ca6-91ca2954f9e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dblnja7xtcs7f", "content": "CVE-2026-92161 - FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider\nCVE ID : CVE-2026-92161\n \n Published : Sept. 25, 2026, 4:17 p.m. | 1\u00a0hour, 28\u00a0minutes ago\n \n Description : FriendsOfFlarum OAuth allows users to log in...", "creation_timestamp": "2026-09-25T17:57:01.757378Z"} {"uuid": "862e4eb7-5680-4cf2-9ca6-91ca2954f9e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dblnja7xtcs7f", "content": "CVE-2026-92161 - FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider\nCVE ID : CVE-2026-92161\n \n Published : Sept. 25, 2026, 4:17 p.m. | 1\u00a0hour, 28\u00a0minutes ago\n \n Description : FriendsOfFlarum OAuth allows users to log in...", "creation_timestamp": "2026-09-25T17:57:01.757378Z"} https://vulnerability.circl.lu/sighting/862e4eb7-5680-4cf2-9ca6-91ca2954f9e6/export Fri, 25 Sep 2026 17:57:01 +0000 https://vulnerability.circl.lu/sighting/5ef0caeb-05ac-4a4c-914a-0141aabae6f4/export {"uuid": "5ef0caeb-05ac-4a4c-914a-0141aabae6f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://gist.github.com/alon710/ce948372dcaedff5ad40dfc5f894ab79", "content": "# CVE-2026-92161: CVE-2026-92161: Unauthenticated Account Takeover in FriendsOfFlarum OAuth Extension\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92161\n\n## Summary\nA critical logical vulnerability in the FriendsOfFlarum OAuth (fof/oauth) extension allows unauthenticated remote attackers to perform complete account takeover, including administrative profiles. This vulnerability is caused by a failure to verify the email verification status returned by third-party identity providers such as Discord before asserting that the email is trusted and matching it to existing local accounts.\n\n## TL;DR\nUnauthenticated remote account takeover via unverified identity provider email trust violation (CVE-2026-92161).\n\n## Technical Details\n\n- **CWE ID**: CWE-345\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8\n- **EPSS Score**: 0.00\n- **Impact**: Critical (Confidentiality, Integrity, Availability)\n- **Exploit Status**: None (PoC concepts documented)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- FriendsOfFlarum OAuth Extension (fof/oauth)\n\n## Mitigation\n\n- Upgrade FriendsOfFlarum OAuth extension to 1.7.4 or 2.0.0-beta.4\n- Disable affected third-party login providers (Discord, GitLab, Google, LinkedIn) temporarily if an immediate upgrade is not possible\n\n**Remediation Steps:**\n1. Identify the current installed version of fof/oauth.\n2. Run 'composer update fof/oauth:1.7.4' for Flarum 1.x or 'composer update fof/oauth:2.0.0-beta.4' for Flarum 2.x.\n3. Clear Flarum's cache using 'php flarum cache:clear'.\n4. Confirm that the patched code is applied by inspecting providers for conditional verification checks.\n\n## References\n\n- [GitHub Security Advisory GHSA-g7vj-c29h-3h5m](https://github.com/FriendsOfFlarum/oauth/security/advisories/GHSA-g7vj-c29h-3h5m)\n- [Official CVE.org Record for CVE-2026-92161](https://www.cve.org/CVERecord?id=CVE-2026-92161)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92161) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T16:30:32.000000Z"} {"uuid": "5ef0caeb-05ac-4a4c-914a-0141aabae6f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://gist.github.com/alon710/ce948372dcaedff5ad40dfc5f894ab79", "content": "# CVE-2026-92161: CVE-2026-92161: Unauthenticated Account Takeover in FriendsOfFlarum OAuth Extension\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92161\n\n## Summary\nA critical logical vulnerability in the FriendsOfFlarum OAuth (fof/oauth) extension allows unauthenticated remote attackers to perform complete account takeover, including administrative profiles. This vulnerability is caused by a failure to verify the email verification status returned by third-party identity providers such as Discord before asserting that the email is trusted and matching it to existing local accounts.\n\n## TL;DR\nUnauthenticated remote account takeover via unverified identity provider email trust violation (CVE-2026-92161).\n\n## Technical Details\n\n- **CWE ID**: CWE-345\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8\n- **EPSS Score**: 0.00\n- **Impact**: Critical (Confidentiality, Integrity, Availability)\n- **Exploit Status**: None (PoC concepts documented)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- FriendsOfFlarum OAuth Extension (fof/oauth)\n\n## Mitigation\n\n- Upgrade FriendsOfFlarum OAuth extension to 1.7.4 or 2.0.0-beta.4\n- Disable affected third-party login providers (Discord, GitLab, Google, LinkedIn) temporarily if an immediate upgrade is not possible\n\n**Remediation Steps:**\n1. Identify the current installed version of fof/oauth.\n2. Run 'composer update fof/oauth:1.7.4' for Flarum 1.x or 'composer update fof/oauth:2.0.0-beta.4' for Flarum 2.x.\n3. Clear Flarum's cache using 'php flarum cache:clear'.\n4. Confirm that the patched code is applied by inspecting providers for conditional verification checks.\n\n## References\n\n- [GitHub Security Advisory GHSA-g7vj-c29h-3h5m](https://github.com/FriendsOfFlarum/oauth/security/advisories/GHSA-g7vj-c29h-3h5m)\n- [Official CVE.org Record for CVE-2026-92161](https://www.cve.org/CVERecord?id=CVE-2026-92161)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92161) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T16:30:32.000000Z"} https://vulnerability.circl.lu/sighting/5ef0caeb-05ac-4a4c-914a-0141aabae6f4/export Fri, 25 Sep 2026 16:30:32 +0000