[CRITICAL] FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

PKSA-4zg4-dqk9-5wt7 CVE-2026-92161 GHSA-g7vj-c29h-3h5m

Affected package: fof/oauth

Affected version: >=2.0.0-beta.1,<2.0.0-beta.4|<1.7.4

Reported by:
GitHub