CVE-2026-48611: Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations

Synopsis

An authentication bypass vulnerability in phpBB's OAuth implementation allows a remote, unauthenticated attacker to hijack user accounts even on installations where OAuth is not configured or enabled. The flaw is reachable over the network with no credentials required and no user interaction needed. Successful exploitation gives an attacker full read, write, and availability control over the affected phpBB instance. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the phpBB service via HTTP/HTTPS from any remote origin.

• AuthenticationNot required

  No credentials of any kind are needed; the flaw bypasses authentication entirely, making it exploitable by any unauthenticated party.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; exploitation is fully self-contained and requires no social engineering.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special pre-conditions such as race conditions or specific memory layout requirements.

Blast Radius

• An attacker reads private messages, email addresses, stored session tokens, and any other user data held in the phpBB database.
• An attacker modifies or deletes forum posts, user profiles, and administrator settings, permanently altering persisted content.
• An attacker hijacks arbitrary user accounts, including administrator accounts, gaining full control over the forum and its configuration.
• An attacker can crash or destabilize the phpBB service, denying access to legitimate users.