CVE-2026-32113: Discourse: Open redirect via `sso_destination_url` cookie in `enter`
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the enter action in StaticController reads the ssodestinationurl cookie and redirects to it with allowotherhost: true without validating the destination URL. While this cookie is normally set during legitimate DiscourseConnect Provider flows with cryptographically validated SSO payloads, cookies are client-controlled and can be set by attackers. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32113?
CVE-2026-32113 has a medium severity level due to its potential for open redirect exploitation.
How do I fix CVE-2026-32113?
To fix CVE-2026-32113, upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0 or later.
What versions of Discourse are affected by CVE-2026-32113?
CVE-2026-32113 affects Discourse versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest before 2026.3.0.
What types of attacks can CVE-2026-32113 enable?
CVE-2026-32113 can potentially enable open redirect attacks, allowing an attacker to redirect users to malicious sites.
Is CVE-2026-32113 a common vulnerability in Discourse?
CVE-2026-32113 is a specific vulnerability related to the sso_destination_url cookie in Discourse and not a common issue in all versions.