Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

Fix availableCritical · CVSS 9.8EPSS 0.27%

Published Sep 25, 2026 · updated Sep 25, 2026

What to do

  1. Upgrade to a fixed version: fof/oauth 1.7.4, fof/oauth 2.0.0-beta.4.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Composerfof/oauth

Vulnerable versions
< 1.7.4
Fixed in
1.7.4

Check your project: composer show fof/oauth

Composerfof/oauth

Vulnerable versions
>= 2.0.0-beta.1, < 2.0.0-beta.4
Fixed in
2.0.0-beta.4

Check your project: composer show fof/oauth

Sources

CWE-345 Insufficient Verification of Data Authenticity

← All critical vulnerabilities