CVE-2026-48611

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

Score

CVSS 3.0 9.8 Critical

Status

Deferred - support@hackerone.com

Published

2026-06-12

Last modified

2026-06-12

Weaknesses

CWE-287

Affected products

• Phpbb (Phpbb)

References

• https://www.phpbb.com/community/viewtopic.php?t=2672170