The flaw allows an attacker to bypass the Discourse allowed_iframes origin check by placing the allowlisted domain suffix after a URL authority separator. The server incorrectly validates the domain, permitting the crafted URL to pass while the browser sees a different origin. This results in an attacker‑controlled iframe being rendered on a site that otherwise protects against foreign content. An adversary can use the iframe to phish, steal credentials, or execute malicious scripts within the context of the site.

Affected systems are Discourse installations running any version prior to 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0. The vulnerability arises only when site administrators configure the allowed_iframes setting to include a wildcard pattern. The flaw was fixed in the mentioned releases by correcting the origin validation logic.

The CVSS score of 4.3 indicates moderate risk, and the EPSS score is unavailable, suggesting limited data on exploitation frequency. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker can create a post or trigger an oEmbed request for a URL under their control, and that the target site has a wildcard allowlist enabled. Once exploited, the attacker gains the ability to inject arbitrary iframe content as if it originated from a trusted domain, potentially compromising user trust and data.