CVE-2026-33427
Open Redirect in Discourse Authorization Page Enables Phishing
Publication date: 2026-03-21
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33427 is a low-severity vulnerability in the Discourse open-source discussion platform affecting certain versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2.
An unauthenticated attacker can manipulate the Discourse authorization page to display a domain controlled by the attacker. This means the authorization page can show a misleading domain, which is not validated by the application.
This manipulation facilitates social engineering attacks by tricking users into trusting a malicious domain during the authorization process.
The issue is fixed in the patched versions 2026.1.2, 2026.2.1, and 2026.3.0-latest.1.
How can this vulnerability impact me? :
This vulnerability can impact you by enabling attackers to perform social engineering attacks.
Because the attacker can cause the authorization page to display a domain they control, users may be misled into trusting malicious sites, potentially leading to credential theft or other security breaches.
Although the vulnerability is low severity, it undermines user trust and the integrity of the authorization process.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update your Discourse installation to one of the patched versions: 2026.1.2, 2026.2.1, or 2026.3.0-latest.1.
No known workarounds are available, so applying the update is the recommended immediate step to prevent exploitation.