CVE-2026-32113 Details

An open redirect vulnerability has been identified in Discourse versions 2026.1.0-latest prior to 2026.1.3, 2026.2.0-latest prior to 2026.2.2, and 2026.3.0-latest prior to 2026.3.0. The issue arises in the StaticController's enter action, where the sso_destination_url cookie is read and used for redirection without proper validation of the URL. This vulnerability allows attackers to exploit the cookie, which can be set manually or through other vulnerabilities, to redirect users to malicious sites, potentially leading to phishing attacks.

Users should upgrade to Discourse versions 2026.1.3, 2026.2.2, or 2026.3.0, all of which include the necessary security fix. If an immediate upgrade is not possible, DiscourseConnect Provider can be disabled as a temporary measure.