PT-2026-29303 · Discourse · Discourse

Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-32113

Mitre

CVSS v4.0

5.1

Medium

AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the enter action in StaticController reads the sso destination url cookie and redirects to it with allow other host: true without validating the destination URL. While this cookie is normally set during legitimate DiscourseConnect Provider flows with cryptographically validated SSO payloads, cookies are client-controlled and can be set by attackers. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-32113

Affected Products

Discourse

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32113 · Security Note
• https://github.com/discourse/discourse/commit/080408b93d00305b51d71f63f755f43fa601884d · Note
• https://github.com/discourse/discourse/security/advisories/GHSA-378j-ccw4-4fwh · Note
• https://meta.discourse.org/t/using-discourse-as-a-sso-provider/32974 · Note