CVE-2026-104480

Executive Summary

CVE-2026-104480 is a logic and validation flaw in Discord's libdave library (versions before 1.2.0) where the client failed to reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker controlling the DAVE signaling path — the voice gateway or any equivalent position able to add, alter, or withhold signaling messages — can force affected clients to accept an unauthorized member into the end-to-end encrypted media session. The impact is a full compromise of the confidentiality and integrity of audio and video, with no public PoC, no Nuclei template, no exploit code, and no CISA KEV listing at the time of writing.

Technical Analysis

libdave implements Discord's DAVE (Discord Audio & Video End-to-End Encryption) protocol, which relies on the MLS (Messaging Layer Security) protocol for group key agreement and member management. In MLS, group membership is established and evolved through handshake messages. A new member is added to a group when an existing member commits an Add proposal; the joining client then receives a Welcome message that carries the group state, including the current roster and the cryptographic material needed to derive the group's secrets.

The vulnerability class here is CWE-390: Detection of Error Condition Without Action. The client processed the Welcome message and either accepted the roster as authoritative, or detected an inconsistency (an "unrecognized participant" in the roster) but did not take the required action — namely, rejecting the Welcome and aborting the join or membership update. Because the Welcome message is the trust anchor for a joining client's view of the group, the client's failure to validate that every participant in the roster is an expected/authorized participant means a roster containing an attacker-controlled identity is treated as legitimate.

The trust boundary that is violated is the DAVE signaling path. The NVD description states that the attacker is "in control of the DAVE signaling path (the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client)." This is a privileged network/positional attacker model: the attacker must be able to sit on, or impersonate the server side of, the MLS/DAVE signaling channel that delivers handshake messages. The client is expected to enforce membership policy locally, i.e., to independently verify that the group roster (in the Welcome) only contains participants it expects. The vulnerable behavior is the absence of that enforcement — the client does not reject a Welcome whose roster contains an unrecognized participant.

The consequence is that the E2EE media session's membership is attacker-influenced: an unauthorized participant is accepted into the group. Once the unauthorized member has been accepted into the MLS group, that member is treated as a legitimate group member by the victim client. Depending on protocol mechanics, an accepted member holds (or can derive) the group's media encryption keys and can decrypt and/or inject media for the session. The NVD description explicitly states the outcome is "compromising the confidentiality and integrity of audio and video."

No public information is available in the supplied data on the exact internal function or module names within libdave that perform Welcome handling or roster validation, so no code-level function names, file paths, or API parameters can be confirmed. Any such specifics would be fabrication. What is established: (a) the affected component is libdave before 1.2.0; (b) the missing logic is the rejection of a Welcome whose roster includes an unrecognized participant; (c) the required attacker position is control over DAVE signaling; (d) the effect is unauthorized group membership and resulting media confidentiality/integrity loss.

Note that E2EE voice/video integrity matters because users may assume that "end-to-end encrypted" implies that only the displayed participant list can hear or be heard. This CVE breaks that assumption: a voice-gateway-position attacker can silently introduce a listener/speaker that the victims' clients accept, defeating the membership guarantee of E2EE even though cryptography itself is not directly broken.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description, and uses only terms given in the description.

1) Reconnaissance / target identification. The attacker must obtain a position on the DAVE signaling path. This is not a remote unauthenticated internet attack against an arbitrary host; the attacker must be (or impersonate) the voice gateway, or occupy any equivalent position capable of adding, altering, or withholding signaling messages delivered to a client. Practically, this means a compromised or malicious voice-gateway-adjacent service, a network MITM positioned on the signaling path, or a server-side actor able to manipulate the signaling stream.

2) Triggering the specific flaw class (CWE-390). In MLS, when a client is added to a group, it receives a Welcome message that establishes the group and its roster. The attacker crafts or modifies a Welcome (or the sequence of signaling messages leading to it) so that the roster the client receives contains an unrecognized participant — an identity the client was never expected to have. Because libdave before 1.2.0 does not reject a Welcome when the resulting group roster contains an unrecognized participant, the client detects no actionable inconsistency (or ignores it) and proceeds to accept the group state.

3) Payload/execution method at the vulnerability-class level. The "payload" is an altered or injected signaling message carrying a manipulated Welcome/roster. The attacker does not need a memory-corruption exploit or arbitrary code execution; the vulnerability is a missing validation action (CWE-390 — detection without action). The attacker simply supplies signaling input that the client should reject but does not. Because the attacker controls the signaling path, they can also withhold legitimate messages or interleave them to make the malicious roster appear consistent with the session flow.

4) Post-exploitation impact. With the unauthorized member accepted into the group roster, the attacker's identity is a member of the E2EE media session. The attacker can then compromise confidentiality (decrypt/receive audio and video) and integrity (inject, alter, or replay media) of the session. This is persistent for the duration of the session/group state and may extend to subsequent epochs depending on how the group's membership state evolves, though the supplied data does not detail epoch/key-derivation behavior beyond membership acceptance.

Constraints and caveats: exploitation requires the privileged signaling-path position, which bounds the attack realistically to server-side/insider/MITM scenarios rather than the general internet. No exploit code, PoC, or Nuclei template is publicly available; no in-the-wild exploitation is confirmed by any data provided.

Impact Assessment

CVSS score and vector are not provided (N/A) in the supplied data. Analyst-derived vector (informative only, not vendor-authoritative): CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N. Rationale: network-reachable signaling path (AV:N); high complexity and specific positional prerequisites (AC:H); attacker requires some level of access/position on the signaling path (PR:L); no user interaction beyond normal use (UI:N); scope unchanged because the vulnerable component is the client library (S:U); high confidentiality impact (audio/video decryption/listening) and high integrity impact (media injection/alteration). No availability impact is stated in the description.

Business impact: any organization or user relying on Discord DAVE E2EE voice/video for sensitive conversations — including security operations voice bridges, incident-response calls, legal/executive communications, and regulated-industry meetings — should assume that media confidentiality and integrity can be subverted by an adversary who controls the voice-gateway/signaling path. The blast radius is bounded by the attacker's ability to occupy that position, but the impact per session is severe: a silent unauthorized participant in an "end-to-end encrypted" call. Data affected: real-time audio and video (content, potentially metadata associated with membership). Multi-tenant blast radius is possible if a shared gateway is compromised, as the signaling path serves many clients.

CWE-390 indicates the defect is a failure to act on an error condition, meaning detection telemetry may exist (the client could, in principle, log the unrecognized participant) but the action was not enforced. This makes reliable detection dependent on instrumentation around roster validation, which the vulnerable versions may not emit.

Detection Guidance

Sigma Rule

title: Potential Discord libdave Unauthorized MLS Group Member Acceptance (CVE-2026-104480)
status: experimental
description: Detects client-side or server-side log events indicating an MLS Welcome/roster was processed that contained an unrecognized participant, consistent with CVE-2026-104480 in libdave before 1.2.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104480
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: discord
  service: dave
detection:
  selection_event:
    - EventID: 'DAVE_WELCOME_RECEIVED'
    - dave_event|contains: 'welcome'
    - dave_event|contains: 'roster'
  selection_anomaly:
    - roster_participant_recognized: 'false'
    - unrecognized_participant|contains: 'true'
    - membership_validation|contains: 'failed'
  condition: selection_event and selection_anomaly
falsepositives:
  - Legitimate joins where roster parsing is incomplete or logging is verbose
  - Test/staging environments with synthetic participants
level: high
tags:
  - attack.t1195
  - cve.2026-104480

YARA Rule

rule CVE_2026_104480_libdave_MLS_Welcome
{
    meta:
        author = "Threat Intelligence"
        description = "Detects libdave binaries/strings referencing MLS Welcome handling without roster rejection (CVE-2026-104480)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104480"
        date = "2026-01-01"
        severity = "high"

    strings:
        $libdave = "libdave" ascii wide nocase
        $welcome = "Welcome" ascii wide
        $roster = "roster" ascii wide nocase
        $mls = "MLS" ascii wide
        $unrecognized = "unrecognized" ascii wide nocase

    condition:
        $libdave and ($mls or $welcome) and ($roster or $unrecognized)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-104480 Discord libdave MLS Welcome roster anomaly"; flow:established,to_client; content:"Welcome"; nocase; content:"roster"; nocase; content:"MLS"; nocase; threshold: type limit, track by_src, count 1, seconds 60; classtype:policy-violation; reference:cve,2026-104480; sid:2026104480; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [any where event.action == "dave_signal_received" and dave.message_type == "welcome"]
  [any where event.action == "dave_roster_processed" and dave.unrecognized_participant == true]

Splunk SPL Query

index=discord OR index=voice sourcetype=libdave:signaling ("MLS" OR "welcome") ("roster" OR "participant")
| where (unrecognized_participant="true" OR membership_validation="failed" OR roster_participant_recognized="false")
| stats count min(_time) as first_seen max(_time) as last_seen values(participant_id) as participants values(src_ip) as src_ips by host, user
| where count > 0

Wazuh OSSEC Rule

<group name="discord,libdave,cve-2026-104480,">
  <rule id="202610" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">dave_roster_processed</field>
    <field name="dave.unrecognized_participant">true</field>
    <description>CVE-2026-104480: libdave accepted MLS Welcome with unrecognized participant - unauthorized E2EE group member.</description>
    <mitre>
      <id>T1195</id>
    </mitre>
    <group>cve_2026_104480,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Vendor fix: N/A. Workarounds: N/A per supplied data. No affected-version list or OSV package mapping was provided. Treat the following as conservative hardening guidance, not a substitute for an authoritative vendor patch.

1. Immediate mitigations

• Do not rely on DAVE E2EE voice/video for confidential, privileged, or regulated communications until an authoritative fix is available and verified. Where possible, move sensitive voice/video to an independently verifiable E2EE channel or in-person/in-person-equivalent methods.
• Reduce exposure of the DAVE signaling path: restrict and monitor who/what can occupy the voice-gateway position; enforce strong server-side authentication and isolation for gateway services to prevent an attacker from attaining the "equivalent position" described in the CVE.
• Treat gateway/voice services as high-value infrastructure: network-segment, apply least privilege, and log all signaling message add/alter/withhold actions.
• Where client instrumentation permits, enable and alert on any roster/membership validation logs; a detected "unrecognized participant" without rejection is the signature of this defect.
• Re-verify the participant list in any E2EE session out-of-band (e.g., expected-attendee confirmation) and terminate the session if an unexpected member appears.

2. Patch/upgrade steps

• Upgrade libdave to 1.2.0 or later when a vendor-published, verifiable release is available. The CVE baseline is "before 1.2.0"; however, patch confidence is currently 0/4 with no tracked patch source, so do not assume 1.2.0 is published/validated until confirmed by the vendor.
• Track the Discord/libdave release channel and any vendor security advisory. Re-validate the fix by confirming that a Welcome whose roster contains an unrecognized participant is now rejected.
• If libdave is bundled into another product/client, obtain the updated bundle from that vendor and inventory all clients and services embedding affected versions.

3. Long-term hardening

• Enforce independent client-side membership validation: never accept a group roster as authoritative solely because it arrived over a trusted signaling channel; cross-check expected participants and fail closed on any unrecognized identity.
• Apply fail-closed defaults to all E2EE handshake processing: any detected inconsistency (Error Condition) must produce an action (reject/abort), directly addressing the CWE-390 class.
• Add regression tests for malicious-Welcome scenarios (roster with unrecognized participant) into the libdave/DAVE test suite and CI.
• Harden the DAVE signaling trust model: cryptographic authentication of signaling messages, replay protection, and monitoring for add/alter/withhold tampering.
• Maintain SBOM coverage for client-side E2EE libraries so future libdave CVEs can be rapidly mapped to affected products.

References

• NVD — CVE-2026-104480: https://nvd.nist.gov/vuln/detail/CVE-2026-104480
• CWE-390 — Detection of Error Condition Without Action: https://cwe.mitre.org/data/definitions/390.html
• MITRE ATT&CK — T1195 Supply Chain Compromise: https://attack.mitre.org/techniques/T1195/
• Discord libdave project/repository (verify authoritative release/advisory before relying on any version): https://github.com/discord/libdave
• CISA Known Exploited Vulnerabilities Catalog (no KEV entry for CVE-2026-104480 as of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were provided or confirmed in the source data.