PT-2026-48826 · Phpbb · Phpbb

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-48611

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.3.16

Description Improper authentication checks in the OAuth implementation allow remote unauthenticated account hijacking. This issue can lead to unauthorized access in default installations, even in cases where OAuth is not configured or enabled.

Recommendations Update to version 3.3.16.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-48611

Affected Products

Phpbb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-48611 · Security Note
• https://reddit.com/r/pwnhub/comments/1u3vxui/critical_oauth_flaw_threatens_account_security_in · Reddit Post
• https://phpbb.com/community/viewtopic.php?t=2672170 · Note
• https://twitter.com/threatcluster/status/2065366100624249011 · Twitter Post