CVE-2025-53532: giscus Auth Bypass Vulnerability

CVE-2025-53532 Overview

CVE-2025-53532 is an improper authorization vulnerability [CWE-285] in giscus, a commenting system powered by GitHub Discussions. A flaw in the discussion creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. The issue affects the server-side component of giscus, delivered through giscus.app and self-hosted deployments. Maintainers addressed the issue in commits c43af7806e65adfcf4d0feeebef76dc36c95cb9a and 4b9745fe1a326ce08d69f8a388331bc993d19389.

Critical Impact

Unauthenticated attackers can create arbitrary GitHub Discussions on any repository with giscus installed, enabling spam, phishing content, and reputational abuse.

Affected Products

• giscus server-side component hosted at giscus.app
• Self-hosted giscus deployments prior to the fix commits
• GitHub repositories with the giscus GitHub App installed

Discovery Timeline

• 2025-07-07 - CVE-2025-53532 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53532

Vulnerability Analysis

The giscus API endpoint responsible for creating GitHub Discussions failed to enforce authorization on incoming requests. The handler at pages/api/discussions/index.ts accepted a Bearer token from the Authorization header but never validated it against GitHub's OAuth verification endpoint before invoking the discussion creation logic. Because giscus uses a GitHub App installation token to perform the write, the missing user token check let any caller trigger discussion creation on any repository where the giscus App is installed.

The vulnerability falls under Improper Authorization [CWE-285]. Impact is limited to integrity of the target repository's Discussions surface, with no direct read access to sensitive data or availability degradation. Realistic abuse includes mass spam, injection of phishing links, and defacement of community forums that rely on giscus.

Root Cause

The root cause is the absence of an OAuth token validation call in the POST path of the discussions API. The original code accepted whatever token was supplied and proceeded to create the discussion using the app's elevated privileges. An initial patch introduced a check() function that queries https://api.github.com/applications/{client_id}/token, but the first iteration invoked it without awaiting the returned Promise, so the truthiness test always passed. A follow-up commit corrected the await and simplified the client-ID comparison.

Attack Vector

Exploitation requires only network access to a giscus server instance. An attacker sends a crafted POST request to /api/discussions with an arbitrary or missing Authorization: Bearer header and a body targeting any repository where giscus is installed. No user interaction and no privileges are required.

// Security patch in pages/api/discussions/index.ts
// Adds oAuth token validation before discussion creation
 import { getAppAccessToken } from '../../../services/github/getAppAccessToken';
 import { addCorsHeaders } from '../../../lib/cors';
 import { digestMessage } from '../../../lib/utils';
+import { check } from '../../../services/github/oauth';
 
 async function get(req: NextApiRequest, res: NextApiResponse<IGiscussion | IError>) {
   const params = {
// Source: https://github.com/giscus/giscus/commit/4b9745fe1a326ce08d69f8a388331bc993d19389

// New check() helper in services/github/oauth.ts validates the user token
// against GitHub's OAuth application token verification endpoint
+import { env } from '../../lib/variables';
+
+export async function check(token: string): Promise<boolean> {
+  const { client_id, client_secret } = env;
+  const auth = Buffer.from(`${client_id}:${client_secret}`).toString('base64');
+  return fetch(`https://api.github.com/applications/${client_id}/token`, {
+    method: 'POST',
+    headers: {
+      Accept: 'application/vnd.github+json',
+      Authorization: `Basic ${auth}`,
+    },
+    body: JSON.stringify({ access_token: token }),
+  })
+    .then((response) => response.json())
+    .then((data) => data?.app?.client_id === client_id)
+    .catch(() => false);
+}
// Source: https://github.com/giscus/giscus/commit/c43af7806e65adfcf4d0feeebef76dc36c95cb9a

// Follow-up fix ensures the Promise returned by check() is awaited
 async function post(req: NextApiRequest, res: NextApiResponse<{ id: string } | IError>) {
   const userToken = req.headers.authorization?.split('Bearer ')[1];
-  if (!check(userToken)) {
+  if (!(await check(userToken))) {
     res.status(403).json({ error: 'Invalid or missing access token.' });
     return;
   }
// Source: https://github.com/giscus/giscus/commit/c43af7806e65adfcf4d0feeebef76dc36c95cb9a

Detection Methods for CVE-2025-53532

Indicators of Compromise

• Newly created GitHub Discussions on repositories using giscus that do not correspond to any real page comment thread
• Discussion authors mapped to the giscus GitHub App identity rather than expected community users
• Bursts of POST requests to /api/discussions on self-hosted giscus servers originating from a small set of IPs
• Discussion titles or bodies containing phishing URLs, spam content, or unfamiliar external links

Detection Strategies

• Review giscus server access logs for POST /api/discussions responses returning 200 where the Authorization header was missing, malformed, or unverifiable.
• Audit GitHub Discussions creation events via the GitHub audit log API and correlate against expected traffic to giscus-enabled pages.
• Compare pre- and post-patch discussion creation rates on affected repositories to identify anomalies.

Monitoring Recommendations

• Enable webhook or audit-log alerts for discussion.created events on repositories with giscus installed.
• Monitor giscus server versions and confirm both fix commits are present in the deployed build.
• Track outbound traffic from giscus servers to api.github.com/applications/{client_id}/token to confirm the token verification path is active.

How to Mitigate CVE-2025-53532

Immediate Actions Required

• Upgrade self-hosted giscus deployments to a build that includes commits 4b9745fe1a326ce08d69f8a388331bc993d19389 and c43af7806e65adfcf4d0feeebef76dc36c95cb9a.
• Audit GitHub Discussions on repositories with giscus installed and remove any spam, phishing, or unauthorized entries.
• Rotate the giscus GitHub App client secret if abuse is suspected on your instance.

Patch Information

The vulnerability is fixed by two commits in the giscus repository. The first commit introduces an OAuth check() function that validates the caller's token against GitHub's application token verification endpoint. The second commit corrects an await bug that caused the check to always pass. Refer to the GitHub Security Advisory GHSA-w6vg-v24f-4vm3, the initial patch commit, and the follow-up fix.

Workarounds

• Restrict network access to the giscus API endpoint using upstream WAF or reverse-proxy rules until patching is complete.
• Temporarily uninstall the giscus GitHub App from high-value repositories where discussion integrity is critical.
• If self-hosting, block unauthenticated POST requests to /api/discussions at the proxy layer.

# Example nginx rule to require an Authorization header on discussion creation
location = /api/discussions {
    if ($request_method = POST) {
        if ($http_authorization !~* "^Bearer \S+$") {
            return 401;
        }
    }
    proxy_pass http://giscus_backend;
}