FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

fof/oauth (composer)

### Impact An unauthenticated account takeover vulnerability exists in `fof/oauth` when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with `"verified": false`. Affected versions of `fof/oauth`…

First seen: 25 Sept 2026
Last update: 25 Sept 2026, 15:55 UTC
Fixed in: fof/oauth 1.7.4
fof/oauth 2.0.0-beta.4
Identifiers: CVE-2026-92161
Source: GitHub advisory
On the menu as: PHP
Chat apps

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
Severity: critical. Patch status: patched.
Affected: fof/oauth (composer)
Fixed in: fof/oauth 1.7.4, fof/oauth 2.0.0-beta.4
Ids: CVE-2026-92161

### Impact An unauthenticated account takeover vulnerability exists in `fof/oauth` when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with `"verified": false`. Affected versions of `fof/oauth`…

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `fof/oauth`. For each hit, compare the installed version with the fix on the same major line: fof/oauth 1.7.4, fof/oauth 2.0.0-beta.4. If it's lower, give the exact upgrade command for the package manager this repo uses.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-92161") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/FriendsOfFlarum/oauth/commit/baca3466b3b7be51c70a7e0ba966901aefeb344a https://github.com/FriendsOfFlarum/oauth/commit/bb4bf376832e6bb68c579715d2a4b5a92c4a2567 https://github.com/FriendsOfFlarum/oauth/releases/tag/1.7.4 https://github.com/FriendsOfFlarum/oauth/security/advisories/GHSA-g7vj-c29h-3h5m https://github.com/advisories/GHSA-g7vj-c29h-3h5m
https://pwned.coffee/i/friendsofflarum-oauth-unauthenticated-account-takeover-v-cve-2026-92161

Sources

Totalone very hot coffee