Paper/Archive/CVE-2026-48611

CVE-2026-48611

phpBB phpBB — Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading t…

EPSS 4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 90.2.902 × 2018.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

Affected

ProductAffectedFixed inSource

phpBB3.3.0 – 3.3.16–CNA

Scores by source

hackerone (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refphpbb.com/community/viewtopic.php?t=2672170