The vulnerability enables a normal user to create a reminder containing @everyone or @here. When the reminder expires, Quest Bot reposts the stored message into the channel without suppressing mass mentions. If the bot is granted permission to mention everyone, the reminder can ping the entire server or channel, resulting in widespread notifications and potential disruption. The weakness stems from improper handling of mass mention tokens in stored messages, categorized as CWE‑116.

The issue affects the Discord bot family Quest Bot by duck‑organization. Versions prior to 1.0.3 are vulnerable; the fix was introduced in release 1.0.3.

The CVSS score of 8.8 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker be a regular user on the Discord server and that the bot possesses "Mention Everyone" privileges. Once those conditions are met, the attacker can trigger the reminder to broadcast mass mentions, which may lead to noise, potential DoS by exhausting resources, and severe annoyance for members.