PT-2026-48826 · Phpbb · Phpbb

CVE-2026-48611 · Published 2026-06-12 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.3.17

Description Improper authentication checks in the OAuth implementation allow for account hijacking and unauthorized access in default installations, even if OAuth is not configured or enabled. This authentication bypass allows an unauthenticated attacker to log in as any user, including administrators, using a single HTTP request without requiring a password. Real-world exploitation attempts have been detected, and over 10,000 potentially affected devices have been identified via FOFA.

Recommendations Update phpBB to version 3.3.17.

Fix

LPE

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-48611

Affected Products

Phpbb

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2026-48611 · Security Note
• https://twitter.com/pdnuclei_bot/status/2073995394988839045 · Twitter Post
• https://twitter.com/lyrie_ai/status/2075516988084924701 · Twitter Post
• https://twitter.com/fofabot/status/2067185479682785635 · Twitter Post
• https://v.redd.it/5tqu9xzwr7ch1 · Reddit Post
• https://pentest-tools.com/research/phpbb-authentication-bypass · Reddit Post
• https://twitter.com/infoflowcloud/status/2065463249064071293 · Twitter Post
• https://reddit.com/r/pentest_tools_com/comments/1uciypg/our_research_team_found_2_vulns_in_phpbb · Reddit Post
• https://twitter.com/kev_intel/status/2079118181457629577 · Twitter Post
• https://twitter.com/lyrie_ai/status/2075516985035592099 · Twitter Post
• https://twitter.com/threatcluster/status/2065366100624249011 · Twitter Post
• https://twitter.com/lyrie_ai/status/2075516986977566753 · Twitter Post
• https://phpbb.com/community/viewtopic.php?t=2672170 · Note
• https://twitter.com/aviatrixtrc/status/2065586055399522424 · Twitter Post
• https://t.me/CVEtracker/56671 · Telegram Post