CVE-2026-104480: Discord's libdave accepts rogue MLS Welcome

A flaw rated 9.4 in Discord's libdave library, which implements the DAVE protocol for calls, lets clients accept an MLS Welcome containing an unrecognised participant. An attacker controlling the DAVE signalling path can add an unauthorised member to an end-to-end encrypted group call in versions below 1.2.0.

• Flaw affects libdave below 1.2.0, severity rated 9.4
• Client accepts an MLS Welcome with an unknown participant
• Attacker must control the DAVE signalling path
• Fix is updating to libdave 1.2.0 or later