A legitimate Discourse authorization page can be coaxed into showing an attacker‑controlled domain, enabling social engineering attacks against users. The vulnerability is not a direct code execution flaw; instead it manipulates the authorization flow to redirect users to malicious sites. Exploitation could persuade users to click links or input credentials, compromising confidentiality and trust in the platform.

Discourse versions prior to 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 are affected. Those specific releases contain the patch. All other publicly released Symptom‑free versions are not listed as vulnerable.

The CVSS score of 2.7 indicates a low impact, and the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not in the CISA KEV catalog, which further reduces its immediate threat visibility. The attack does not require authentication; an unauthenticated user can trigger the redirect by accessing the authorization endpoint. Because the flaw enables social engineering, the main risk lies in user intent rather than system compromise.