Improper Authentication in OAuth Implementation Affects phpBB Software
CVE-2026-48611
9.8CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-48611?
The OAuth implementation in phpBB has a critical flaw where improper authentication checks can lead to account hijacking. This vulnerability is particularly concerning as it may allow unauthorized users to gain access to accounts even if OAuth is not configured or enabled. Default installations are especially at risk, making it crucial for users to assess their security posture and apply necessary patches promptly.
Affected Version(s)
phpBB 3.3.0 <= 3.3.16
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.