github.comConfirmation
https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf CVE-2025-48954
HIGHNuclei
Discourse vulnerable to XSS via user-provided query parameter in oauth failure flow
Record summary
CVE-2025-48954 has a selected CVSS score of 8.1 (high); EIP currently links 1 Nuclei template.
Description
Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't enabled when using social logins. Version 3.5.0.beta6 patches the issue. As a workaround, have the content security policy enabled.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 25, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
discourseBrowse discourse / discourse | CVE List | < 3.5.0.beta6 | affected |
Nuclei templates
1ProjectDiscoveryHIGHDiscourse OAuth Social Login - Cross-site ScriptingCVSS 8.1
Discourse versions prior to 3.5.0.beta6 contain a stored Cross-Site Scripting (XSS) vulnerability in the OAuth/social login functionality. The vulnerability is caused by lack of proper content security policy enforcement when processing social login failures,allowing remote attackers to inject and execute malicious scripts in users' browsers.
Impact
Attackers can inject malicious scripts through the provider parameter in OAuth login failures, executing JavaScript in victim browsers and potentially achieving session hijacking.
Remediation
Update the discourse to version 3.5.0.beta6 or later.
WeaknessesCWE-79
Authorsferreiraklet, DhiyaneshDK, pdresearch
Template tagscvecve2025discoursexssoauthvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CPE: cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*
Shodan: http.component:"Discourse"
FOFA: app="Discourse"
https://github.com/discourse/discourse/security/advisories/GHSA-26p5-mjjh-wfcf https://nvd.nist.gov/vuln/detail/CVE-2025-48954
Source: ProjectDiscovery