CVE-2026-92161— FriendsOfFlarum OAuth 未验证邮箱信任导致未授权账户接管
一分钟漏洞结论
影响对象
FriendsOfFlarum oauth
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
FriendsOfFlarum OAuth 插件允许用户使用 GitHub、Twitter、Facebook 等第三方提供商登录 Flarum。在版本 1.7.4 和 2.0.0-beta.4 之前，Discord OAuth 提供商在调用 将邮箱地址作为可信邮箱传递给 Flarum 核心之前，未检查 Discord 返回的“邮箱是否已验证”（verified）字段。因此，当启用 Discord 登录功能时，攻击者只要知道某位 Flarum 用户的邮箱地址，便可创建一个 Discord 账户，使用该未经验证的邮箱地
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-92161 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
来源: CVE Program / CVE List V5
Vulnerability Description
FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail(). When Discord sign-in is enabled, an unauthenticated attacker who knows the email address of a Flarum user can configure a Discord account with that unverified address and a verified phone number, then sign in to cause Flarum to match the trusted address, link the attacker-controlled Discord identity to the existing user, and authenticate as the victim without a password or victim interaction. Exploitation requires that the victim's email address is not already associated with a Discord account, and it can compromise administrator accounts. Other bundled providers were not confirmed to be practically exploitable by this method because their relevant authentication flows return only verified or confirmed email addresses. This issue is fixed in versions 1.7.4 and 2.0.0-beta.4.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| FriendsOfFlarum | oauth | < 1.7.4 | - |
|
二、漏洞 CVE-2026-92161 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-92161 的情报信息
请登录查看更多情报信息。
CVE-2026-92161 其他参考 (5)
-
https://github.com/FriendsOfFlarum/oauth/releases/tag/1.7.4 x_refsource_MISC
-
https://github.com/FriendsOfFlarum/oauth/releases/tag/2.0.0-beta.4 x_refsource_MISC
-
https://github.com/FriendsOfFlarum/oauth/security/advisories/GHSA-g7vj-c29h-3h5m x_refsource_CONFIRM
IV. Related Vulnerabilities
V. Comments for CVE-2026-92161
暂无评论