The FriendsOfFlarum OAuth integration with Discord prior to version 1.7.4 and in versions from 2.0.0-beta.1 up to but not including 2.0.0-beta.4 does not verify the 'verified' field of the email address returned by Discord's OAuth response before passing it as a trusted email to Flarum core. This allows an unauthenticated attacker who knows a victim's email address to register a Discord account with that unverified email and a verified phone number, then sign in via Discord OAuth. Flarum will link the attacker-controlled Discord identity to the existing user account and authenticate the attacker as that user without requiring a password or victim interaction. Other OAuth providers bundled with FriendsOfFlarum were not confirmed to be exploitable in this manner because they only return verified or confirmed emails. The vulnerability is resolved in versions 1.7.4 and 2.0.0-beta.4.

Successful exploitation allows an unauthenticated attacker to impersonate any Flarum user, including administrators, by linking a Discord account with an unverified email matching the victim's email. This leads to full account compromise without requiring the victim's password or interaction. The attack requires that the victim's email is not already associated with a Discord account. The vulnerability impacts confidentiality, integrity, and availability of affected Flarum user accounts.

This vulnerability is fixed in FriendsOfFlarum OAuth versions 1.7.4 and 2.0.0-beta.4. Users should upgrade to at least these versions to remediate the issue. No other mitigation is required as the fix properly verifies the email's verified status before trusting it. Patch status is confirmed by the vendor advisory.