FriendsOfFlarum OAuth allowed attackers to become authenticated users by exploiting a flaw in the Discord provider that does not verify the verified field on email addresses. An attacker who knows a victim’s email can create a Discord account with the same unverified address and a phone number that is verified. When that account logs in, the OAuth process treats the address as trusted, links the Discord identity to the existing Flarum user, and logs the attacker in as that victim. This grants the attacker full access to the victim’s account, including administrator accounts. The weakness is a failure to verify ownership of an email address, classified as CWE‑345. The result is an unauthenticated account takeover without user interaction.

The affected vendor is FriendsOfFlarum, product FriendsOfFlarum:oauth. Versions before 1.7.4 and before 2.0.0‑beta.4 are vulnerable. Those releases did not guard against unverified email addresses in Discord OAuth. Users running any of those versions are at risk.

The flaw has a CVSS score of 9.8, indicating critical severity. The EPSS score is not available, but the lack of constraints on the attacker’s ability and low technical barrier make exploitation likely in practice. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS and the demonstrated exploitability imply a high likelihood of real‑world attacks. The attack vector requires an unauthenticated attacker to create a Discord account with the victim’s email; no victim interaction is needed other than having the victim’s email unlinked from a Discord account. Once the attacker signs in via Discord, the system automatically associates the compromised identity with the victim’s account, allowing immediate authentication as the victim.