Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-Discord — Critical vulnerability report detailing zero-day Remote Debugging Port exposure in Discord macOS client leading to account takeover, spyware, worm propagation, and backdoor persistence. | Kitploit
Tools/GitHubGitHub/nicetop1027/cve-2026-discord
Persistence MechanismsVulnerability AnalysisExploitationData ExfiltrationPenetration TestingRed Teaming
GitHubnicetop1027/cve-2026-discord

CVE-2026-Discord

Critical vulnerability report detailing zero-day Remote Debugging Port exposure in Discord macOS client leading to account takeover, spyware, worm propagation, and backdoor persistence.

View Repository
87 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Critical Vulnerability Report: Discord macOS Client

Date: 2026-01-25 Target: Discord Client (macOS Stable 0.0.373) Author: Antigravity

🚨 Executive Summary

We have identified a critical security vulnerability in the Discord macOS Client (Electron-based) involving the forced exposure of the Remote Debugging Port (9222) via local configuration or command-line flags. This allows a local attacker to completely bypass authentication (2FA, Password) and achieve Remote Code Execution (RCE) context within the client.

CVE Status Check

  • Distinct Vector: This vulnerability is distinct from the previously reported CVE-2024-23739 (RunAsNode RCE).
  • Zero-Day Status: There is currently no assigned CVE for the "Remote Debugging Port Exposure" on Discord macOS. This is classified as a Zero-Day (or Unpatched N-Day) Configuration Vulnerability.
  • New Threat Model: While settings.json injection is a known technique, demonstrating Worm Propagation and Real-Time Spyware capabilities elevates this to a critical security risk.

💥 Exploitation Scenarios (Impact Analysis)

1. Zero-Click Account Takeover (ATO)

  • Mechanism: Invoking getToken() via the Debug Console to extract the unencrypted User Token.
  • Impact: The attacker gains immediate access to the account from any location, bypassing Password and 2FA requirements.

2. Real-Time Spyware (Verified)

  • Mechanism: Utilizing Network.enable and DOM access via the Debug Port to capture all rendered text and WebSocket traffic.
  • Verified PoC: The script discord_spyware_v2.py successfully extracted the victim's Private DM List and Server List (e.g., "White Hat Community", "LGU+ Security Hackathon") as plaintext in real-time.
  • Evidence: See proof_spyware.png (Terminal output showing extracted private UI text).
  • Impact: Complete loss of privacy. Attackers can monitor private conversations and hidden channels silently.

3. Automated Worm Propagation

  • Mechanism: Controlling the Chat Input (Textarea) via DOM manipulation to auto-send malicious links to all friends and server members.
  • Impact: Potentially massive viral spread of malware leveraging the victim's trust.

4. Invisible Persistence (Backdoor)

  • Mechanism: Modifying settings.json to permanently enable the debug port on every application launch.
  • Impact: The backdoor remains active indefinitely without triggering antivirus software, as it uses legitimate Discord flags.

🛠️ Proof of Concept (Technical Verification)

The vulnerability was verified through the following steps:

  1. Exploit: Launching Discord with --remote-debugging-port=9222.
  2. Access: Connecting to the local WebSocket Debugger URL.
  3. Execution: Injecting alert("GOD MODE ACTIVE") to freeze the UI (Screen Defacement) and executing discord_spyware_v2.py to dump screen content.

🛡️ Remediation

  1. Disable Debug Flags: Production builds should explicitly ignore dangerous command-line switches like --remote-debugging-port. (Disable in electron.main).
  2. Integrity Checks: Critical configuration files like settings.json should be signed (HMAC) or encrypted to prevent external tampering.
Download Tool