CVE-2026-104480
Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership
- State
- Published
- Severity
- 9.4 Critical
- Published
- Oct 2, 2026
- Updated
- Oct 2, 2026
- Reserved
- Oct 2, 2026
Description
Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client) could cause affected clients to accept an unauthorized member into the end-to-end encrypted media session, compromising the confidentiality and integrity of audio and video.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | Bugcrowd |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
libdaveDiscord |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.