CVE-2026-48612: Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an attacker-controlled account

Synopsis

An authentication-flow manipulation vulnerability exists in the OAuth implementation of phpBB versions 3.3.16 and earlier. An attacker who already holds a low-privilege account can craft a malicious OAuth flow and trick a victim into completing it, causing the victim's account to be linked to the attacker-controlled account. Successful exploitation gives the attacker full control over the victim's account, including the ability to read private data, alter content, and disrupt service. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the phpBB service over the network to initiate and manipulate the OAuth flow.

• AuthenticationRequired

  The attacker must hold at least a low-privilege phpBB account to initiate the malicious OAuth linking flow.

• Victim interactionRequired

  A victim must be socially engineered into clicking or following the attacker-crafted OAuth authorization link to complete the account linking.

• Attack complexityDetail

  Exploitation involves race conditions or precise sequencing of OAuth state parameters, meaning the attacker must engineer specific environmental conditions rather than firing a simple, condition-free payload.

Blast Radius

• The attacker gains full access to the victim's account, including stored private messages, profile data, and any session credentials tied to that account.
• The attacker can modify or delete the victim's posts, settings, and stored content within the phpBB forum.
• Account takeover allows the attacker to impersonate the victim, potentially escalating to higher-privilege actions if the victim held moderator or administrator roles.
• Depending on phpBB configuration, session tokens issued after account linking may allow lateral movement to connected services that trust the compromised account.