Context

Discord uses discord.new links for server templates. A valid template identifier produces an embedded preview that users can open to create a server from that template.

Discord message containing a discord.new server-template link and its rendered preview card.
A normally rendered Discord server-template preview.

Trigger

I found that the template renderer accepted JavaScript array method names, such as toLocaleString, where a valid template identifier was expected.

Instead of rejecting the invalid identifier once, the client failed to render it and continued retrying in a loop. Even one malformed link generated repeated background requests.

To understand the practical impact, I tested multiple affected links across separate channels. As the requests accumulated, the Discord client began to lag and the account eventually reached Discord's rate limits.

Browser developer tools showing requests named after JavaScript object methods and an API-block response.
Repeated requests and the resulting API-block response in developer tools.

Impact

The request loop caused two observable effects:

  • The Discord desktop client or browser became increasingly unresponsive.
  • The affected account became rate-limited and could not use Discord features for approximately one hour.

The problem was not limited to the template preview. Rendering enough affected links could disrupt the wider Discord session and temporarily lock the account out of normal functionality.

Discord client displaying a red Messages Failed to Load banner during the rate-limit test.
The client failing to load messages during the affected state.
Discord invite dialog warning that API access is temporarily blocked after exceeding rate limits.
Discord's temporary API rate-limit warning.

Disclosure and resolution

I reported the vulnerability to Discord's security team. Discord fixed the issue, and the original behavior can no longer be reproduced.

The report was classified as High severity under Improper Input Validation. Discord awarded me a bounty and the Discord Bug Hunter Badge.

Closed HackerOne report summary showing High severity and Improper Input Validation; the report ID and bounty are redacted.
The resolved report. Identifiers and the bounty amount remain redacted.

This write-up describes behavior that Discord fixed before publication.