Flarum Discord OAuth Plugin Account Takeover Vulnerability

FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to versions 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before passing the address to Flarum core as trusted through provideTrustedEmail().

When Discord sign-in is enabled, an unauthenticated attacker who knows the email address of a Flarum user can configure a Discord account with that unverified address and a verified phone number, then sign in to cause Flarum to match the trusted address, link the attacker-controlled Discord identity to the existing user, and authenticate as the victim without a password or victim interaction.

• Exploitation requires that the victim's email address is not already associated with a Discord account.
• It can compromise administrator accounts.
• Other bundled providers were not confirmed to be practically exploitable because their relevant authentication flows return only verified or confirmed email addresses.
• Fixed in versions 1.7.4 and 2.0.0-beta.4.