{"vulnerability": "CVE-2026-92161", "sightings": [{"uuid": "5ef0caeb-05ac-4a4c-914a-0141aabae6f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://gist.github.com/alon710/ce948372dcaedff5ad40dfc5f894ab79", "content": "# CVE-2026-92161: CVE-2026-92161: Unauthenticated Account Takeover in FriendsOfFlarum OAuth Extension\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-92161\n\n## Summary\nA critical logical vulnerability in the FriendsOfFlarum OAuth (fof/oauth) extension allows unauthenticated remote attackers to perform complete account takeover, including administrative profiles. This vulnerability is caused by a failure to verify the email verification status returned by third-party identity providers such as Discord before asserting that the email is trusted and matching it to existing local accounts.\n\n## TL;DR\nUnauthenticated remote account takeover via unverified identity provider email trust violation (CVE-2026-92161).\n\n## Technical Details\n\n- **CWE ID**: CWE-345\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8\n- **EPSS Score**: 0.00\n- **Impact**: Critical (Confidentiality, Integrity, Availability)\n- **Exploit Status**: None (PoC concepts documented)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- FriendsOfFlarum OAuth Extension (fof/oauth)\n\n## Mitigation\n\n- Upgrade FriendsOfFlarum OAuth extension to 1.7.4 or 2.0.0-beta.4\n- Disable affected third-party login providers (Discord, GitLab, Google, LinkedIn) temporarily if an immediate upgrade is not possible\n\n**Remediation Steps:**\n1. Identify the current installed version of fof/oauth.\n2. Run 'composer update fof/oauth:1.7.4' for Flarum 1.x or 'composer update fof/oauth:2.0.0-beta.4' for Flarum 2.x.\n3. Clear Flarum's cache using 'php flarum cache:clear'.\n4. Confirm that the patched code is applied by inspecting providers for conditional verification checks.\n\n## References\n\n- [GitHub Security Advisory GHSA-g7vj-c29h-3h5m](https://github.com/FriendsOfFlarum/oauth/security/advisories/GHSA-g7vj-c29h-3h5m)\n- [Official CVE.org Record for CVE-2026-92161](https://www.cve.org/CVERecord?id=CVE-2026-92161)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-92161) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T16:30:32.000000Z"}, {"uuid": "862e4eb7-5680-4cf2-9ca6-91ca2954f9e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dblnja7xtcs7f", "content": "CVE-2026-92161 - FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider\nCVE ID : CVE-2026-92161\n \n Published : Sept. 25, 2026, 4:17 p.m. | 1\u00a0hour, 28\u00a0minutes ago\n \n Description : FriendsOfFlarum OAuth allows users to log in...", "creation_timestamp": "2026-09-25T17:57:01.757378Z"}, {"uuid": "b1d6cf3b-b87c-4c36-bef7-295d1c2667eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mweegahdcz2r", "content": "\ud83d\udea8 CVE-2026-92161 \u2014 CVSS 9.8 CRITICAL\n\nFriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers....\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-92161\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T18:07:54.765608Z"}, {"uuid": "30d8795b-aa01-4679-89f8-501975aa5c9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwfuncic6i2k", "content": "\ud83d\udd34 CVE-2026-92161 - Critical (9.8)\n\nFriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-92161/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-26T08:30:52.375263Z"}, {"uuid": "bfa0cece-08ce-44ef-8240-cefceed38a59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-92161", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwgipni7a22q", "content": "CVE-2026-92161 - oauth\nThe FriendsOfFlarum OAuth extension for Flarum (versions before 1.7.4 and 2.0.0\u2011beta.4) trusts email addresses from Discord without confirming they are verified. An attacker who\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#oauth #fof #composer #CVE #infosec", "creation_timestamp": "2026-09-26T14:30:05.322609Z"}]}