Discourse Unauthenticated Domain Injection Vulnerability in Authorization Page

A vulnerability exists in Discourse, an open-source discussion platform, prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. This vulnerability allows an unauthenticated attacker to manipulate a legitimate Discourse authorization page to display an attacker-controlled domain. This could facilitate social engineering attacks against users.

Impact

Exploitation of this vulnerability could lead to social engineering attacks, as it allows an attacker to inject a malicious domain into an authorization page, potentially deceiving users.

Remediation

Users are advised to update to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.