CVE-2026-104480

Critical

Description

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client) could cause affected clients to accept an unauthorized member into the end-to-end encrypted media session, compromising the confidentiality and integrity of audio and video.

SeverityCritical

CVSS9.4

Exploit probability—

ProductDiscord Libdave

PublishedOct 2, 2026

First seenOct 2, 2026

Weakness typeCWE-390CWE-390 CWE-863Incorrect authorization

How to fix

Update

Discord libdave1.2.0, 9686fbaea864aa19f0675e486672b6a77811b6a1 or later

Patches

github.com/discord/libdave/commit/9686fbaea864aa19f0675e486672b6a77811b6a1

Vendor advisories

github.com/discord/libdave/releases/tag/v1.2.0/cpp

Affected products

Product	Affected versions	Fixed in
Discord libdave	1.1.0 ≤ v < 1.2.0, 7b15f1fc16f159da0478aa6be909e38f1e957833 ≤ v < 9686fbaea864aa19f0675e486672b6a77811b6a1	1.2.0, 9686fbaea864aa19f0675e486672b6a77811b6a1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.