CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse

End-to-end encryption for a group call is only as strong as the membership list. CVE-2026-104480 in Discord's libdave, the library that implements the DAVE protocol for Discord calls, is a flaw in how that list is enforced.

The flaw and the protocol it lives in

The affected code is in the MLS (Messaging Layer Security) handshake handling. When a generated group roster contains an unrecognised participant, libdave below 1.2.0 does not reject the incoming MLS Welcome message. An attacker who controls the DAVE signalling path can therefore cause a client to accept an unauthorised member into the group's end-to-end encrypted media session.
The rating is 9.4. The affected range is libdave versions below 1.2.0.
MLS exists to give group communication the property that the server cannot silently add a member. The Welcome message is the artefact that admits a new participant, and the client is supposed to verify that the addition matches what its own view of the group allows. When that check is skipped for unrecognised participants, the server-side guarantee is the only thing left, and the whole point of the protocol is to not rely on that.

Why a call gets a severity of 9.4

An unauthorised member inside an encrypted media session hears and sees everything the legitimate participants do, and it can speak into the session. For a call that is treated as secure precisely because it is end-to-end encrypted, that is a complete loss of the confidentiality property the user relied on.
The attacker position is the signalling path. That is a narrower requirement than the open internet, and it is common enough in practice: the signalling server is a distinct component, and a wrong TLS configuration or a misissued certificate puts an adversary on that path.
There is a second effect that the disclosure does not spell out but that follows from the design. A client that accepts a rogue Welcome may continue to treat the roster as valid, which means the intrusion is invisible in the participant list.

What to do

Update libdave to 1.2.0 or later in every application that embeds it. For most end users this arrives as a client update, so the practical task is to ensure the update is not held back by an enterprise deployment policy that pins an older client build.
For teams that build on libdave, add a test that asserts a Welcome referencing an unknown participant is rejected. The fix is a missing verification, and the regression test is the control that keeps it present.
Administrators should treat signalling integrity as part of the security posture of any encrypted-call deployment. Certificate pinning or a validated private CA on the signalling path removes the attacker position entirely, which is a stronger control than the library fix alone.
Finally, understand the membership model in the deployment. If the service is configured to allow server-driven membership changes, then a client-side verification failure matters more, not less.

References

• CVE-2026-104480 record
• NVD entry for CVE-2026-104480