PatchClock

PHP security digest · Packages

fof/oauth security advisories

1 advisory we have followed since September 2026, 1 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Critical 25 Sep 2026

    FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

    Fixed in 1.7.4, 2.0.0-beta.4 · CVE-2026-92161

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including fof/oauth, and the version that fixes it.