How severe is CVE-2026-92161?

CVE-2026-92161 has a CVSS score of 9.8/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by CVE-2026-92161?

CVE-2026-92161 affects the following packages: fof/oauth (Packagist), fof/oauth (Packagist). Ecosystems affected: Packagist.

How do I fix CVE-2026-92161?

Update fof/oauth to 1.7.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-92161 is resolved across your whole dependency graph.

How do I detect CVE-2026-92161 in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fof/oauth, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-92161 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is CVE-2026-92161 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-92161 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-92161?

CVE-2026-92161 has an EPSS (Exploit Prediction Scoring System) score of 0.3%, placing it in the 19th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2026-92161?

CVE-2026-92161 is classified as CWE-345 (CWE-345). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2026-92161 published, and has it been updated?

CVE-2026-92161 was published on September 25, 2026 and was last updated on October 21, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘

🐘 Packagist

Not in CISA KEV

CRITICAL severity

CVE-2026-92161 — oauth

CRITICALFix: FriendsOfFlarum/oauth@baca346

CVE-2026-92161 is a critical-severity (CVSS 9.8) CWE-345 vulnerability in fof/oauth. A fix is available for fof/oauth — see the affected versions and patch details below.

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

Also known asGHSA-g7vj-c29h-3h5m

Published

Sep 25, 2026

Updated

Oct 21, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Oct 22, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
A successful exploit gives an attacker total control of the affected component, not partial access.
CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-92161.

EPSS Exploitation Probability

via FIRST.org ↗

0.3%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs19th percentile — riskier than 19% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-92161 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected

🐘fof/oauth🐘fof/oauth

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

An unauthenticated account takeover vulnerability exists in fof/oauth when the Discord OAuth provider is enabled.

Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with "verified": false.

Affected versions of fof/oauth did not validate this flag and passed the email address to Flarum core as trusted via provideTrustedEmail(). Flarum core could then match the trusted email address to an existing user, link the attacker-controlled Discord identity to that user, and authenticate the attacker as the victim.

An attacker who knows a user's email address can therefore take over the corresponding Flarum account without knowing its password or requiring any interaction from the victim. This includes administrator accounts.

Preconditions for exploitation

Discord sign-in is enabled on the forum.
The victim has a Flarum account with a known email address.
The victim's email address is not already associated with a Discord account.
The attacker creates or configures a Discord account using the victim's email address without verifying it and verifies a phone number instead.
The attacker authenticates to the forum using that Discord account.

The issue is specific to Discord's ability to return an unverified email address through OAuth. Other bundled providers were not confirmed to be practically exploitable through the same method because they only return verified or confirmed email addresses in the relevant authentication flow.

Patched Versions

Workarounds

Administrators who cannot update immediately should disable the Discord OAuth provider in the extension settings.

Credits

Reported by @faran1512

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`fof/oauth`	all versions	1.7.4`composer require fof/oauth:^1.7.4`
🐘Packagist	`fof/oauth`	≥ 2.0.0-beta.1&&< 2.0.0-beta.4	2.0.0-beta.4`composer require fof/oauth:^2.0.0-beta.4`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for fof/oauth, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update fof/oauth to 1.7.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-92161 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact An unauthenticated account takeover vulnerability exists in `fof/oauth` when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with `"verified": false`. Affected versions of `fof/oauth` did not validate this flag and passed the email address to Flarum core as trusted via `provideTrustedEmail()`. Flarum core could then match the trusted email address to an existing user, link the attacker-controlled Discord identity to that u