Technical impact
Discord libdave before version 1.2.0 fails to reject an MLS Welcome message that contains an unrecognized participant, allowing an attacker to insert an unauthorized member into the end‑to‑end encrypted media session. This flaw is a missing error handling weakness (CWE‑390) coupled with a missing authentication check (CWE‑863). The direct result is that the audio and video streams become potentially accessible to the attacker, violating non‑repudiation and privacy guarantees.
Affected Systems
Discord libdave releases prior to 1.2.0 are affected. The Vendor is Discord and the product is libdave. No specific version range is listed beyond the cutoff of 1.2.0, so all earlier releases are considered vulnerable.
Risk and Exploitability
The CVSS score of 9.4 places this vulnerability in the High category, and the lack of an EPSS score indicates the exploitation likelihood data is unavailable but the high severity still signals a significant risk. The attacker must control or manipulate the DAVE signaling path, which is a network position resembling the voice gateway. Since the vulnerability directly alters the cryptographic participant roster, it enables a compromised party to intercept or modify media streams. Although it is not currently listed in the CISA KEV catalog, the potential for large‑scale compromise warrants immediate attention.
