CVE-2026-32113: 
NixOS vulnerability analysis and mitigation

CVE-2026-32113 is an open redirect vulnerability in Discourse, the open-source discussion platform, affecting the enter action in StaticController. The flaw allows attackers who can set cookies in a victim's browser to redirect authenticated users to arbitrary external URLs via an unvalidated sso_destination_url cookie. Affected versions include 2026.1.0-latest through 2026.1.2, 2026.2.0-latest through 2026.2.1, and 2026.3.0-latest (pre-patch). It was disclosed on March 31, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory).

The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect). In StaticController#enter, the application reads the sso_destination_url cookie and passes its value directly to a redirect call with allow_other_host: true, without validating whether the destination URL belongs to a configured and trusted SSO provider domain. Although this cookie is legitimately set during DiscourseConnect Provider SSO flows with cryptographically validated payloads, cookies are client-controlled, meaning any attacker who can write a cookie in the victim's browser — via subdomain cookie injection, XSS on a related domain, or similar techniques — can set an arbitrary redirect target. The fix, introduced in commit 080408b, adds a valid_sso_redirect_uri? method that parses the cookie value and checks the host against the discourse_connect_provider_secrets site setting using wildcard domain matching before permitting an external redirect (GitHub Advisory, Patch Commit).

Successful exploitation enables phishing attacks, credential harvesting, and malware distribution by silently redirecting authenticated users to attacker-controlled websites immediately after login. The CVSS v4.0 scope change reflects that the subsequent system (e.g., the user's browser and any site they are redirected to) can suffer high confidentiality and integrity impact, even though the Discourse instance itself is not directly compromised. Exploitation requires user interaction (the victim must authenticate via the /login endpoint) and is primarily limited to sites with enable_discourse_connect_provider = true (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.039%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a precondition — the attacker must be able to set a cookie in the victim's browser — which raises the practical bar above a simple unauthenticated attack (GitHub Advisory).

1. Identify target: Confirm the Discourse instance has enable_discourse_connect_provider = true and is running a vulnerable version (2026.1.0–2026.1.2, 2026.2.0–2026.2.1, or unpatched 2026.3.0).
2. Gain cookie-write capability: Obtain the ability to set cookies on the victim's browser for the Discourse domain — via subdomain cookie injection (e.g., exploiting a subdomain that shares the parent domain), XSS on a related domain, or another cookie-setting vulnerability.
3. Set malicious cookie: Write the sso_destination_url cookie with an attacker-controlled URL as its value, e.g., sso_destination_url=https://evil-phishing-site.com/login.
4. Deliver phishing link: Send the victim a link or trigger navigation to the Discourse /login endpoint (e.g., https://forum.example.com/login).
5. Victim authenticates: The victim submits their credentials via POST to /login. The StaticController#enter action reads the sso_destination_url cookie and, without validation, redirects the user to the attacker's URL with allow_other_host: true.
6. Harvest credentials or deliver malware: The victim lands on the attacker-controlled site, which may mimic a legitimate login page to harvest credentials or serve malicious content (GitHub Advisory, Patch Commit).

• Network: HTTP 302 redirect responses from the Discourse /login endpoint pointing to external, non-configured SSO provider domains; outbound connections from users' browsers to unexpected external hosts immediately following Discourse authentication.
• Logs: Discourse application logs showing sso_destination_url cookie values containing external URLs not matching any configured discourse_connect_provider_secrets domain; repeated POST requests to /login.json followed by redirects to external hosts.
• Cookies: Presence of an sso_destination_url cookie set to an external URL on a user's browser outside of a legitimate DiscourseConnect Provider SSO flow.

Upgrade Discourse to patched versions: 2026.1.3 (for 2026.1.x), 2026.2.2 (for 2026.2.x), or 2026.3.0 (for 2026.3.x). As a temporary workaround if immediate upgrade is not possible, disable the DiscourseConnect Provider feature by setting enable_discourse_connect_provider = false in site settings — this prevents the vulnerable code path from executing entirely. Additionally, implementing Content Security Policy (CSP) headers and monitoring authentication logs for suspicious SSO redirect patterns are recommended defensive measures (GitHub Advisory).