Context

Discord's Invite as Guest feature allows someone to temporarily join a server through a voice-channel invitation. The guest should remain tied to that voice channel and be removed from the server when they leave it. Guests should also be unable to view other channels.

Discord's Invite as Guest dialog explaining that guests are removed after leaving the voice channel.
The intended guest restrictions shown in Discord's invitation dialog.

Discovery

I wondered what would happen if an account encountered a rate limit while changing voice channels and then joined through a guest invitation.

Under the right timing conditions, Discord allowed me to join the server without placing me in the intended voice channel. This created an inconsistent membership state: because I was not in the voice channel, the event that should remove a guest could never occur.

Discord test server showing the guest session outside the visible voice-member list while a newly posted channel message remains visible.
The inconsistent guest state: the session persisted while channel content remained accessible.

Impact

The guest session persisted instead of ending as designed. I did not appear in the server's member list, but I could remain in the server and read messages without other members knowing I was present.

Normal moderation behavior was also affected because Discord did not consistently recognize the account as a server member. In my testing, this prevented the account from being banned through the expected flow.

The race condition therefore turned a temporary, voice-bound invitation into persistent unauthorized access.

Disclosure and resolution

I reported the vulnerability to Discord through HackerOne. Discord classified the issue as High severity under Improper Access Control, resolved the report, and awarded a bounty.

Closed HackerOne report summary showing High severity and Improper Access Control; the report ID and bounty are redacted.
The resolved report. Identifiers and the bounty amount remain redacted.

This write-up describes fixed behavior and intentionally omits the report identifier and bounty amount.