SecurityOnlineDo Son
Critical phpBB OAuth flaw lets hackers hijack any account
Part of the CVE-2026-48611 story · since 16 Jun
Quiet for 20 weekslast report 16 Jun1 article1 outlet
- Tue 16 Jun, 01:30 UTC. SecurityOnline, first report. Critical phpBB OAuth flaw lets hackers hijack any account. This article, 1st of 1.
A critical vulnerability (CVE-2026-48611) in phpBB allows unauthenticated attackers to log in as any user, including administrators, compromising numerous online communities. The flaw exists in phpBB's OAuth implementation, requiring only the target's username for exploitation, which can happen even if OAuth is not enabled. This issue, carrying a CVSS score of 9.8, affects all phpBB versions up to 3.3.16 and was patched in version 3.3.17 released on June 6, 2026. Administrators are urged to update immediately or apply temporary mitigations if unable to patch.
How the story developed
Quiet for 20 weekslast report 16 Jun1 article1 outlet
1 article from 1 outlet since 16 Jun. Quiet since 16 Jun. This was the first report.
- Tue 16 Jun, 01:30 UTC. SecurityOnline, first report. Critical phpBB OAuth flaw lets hackers hijack any account. This article, 1st of 1.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 1 articles as a listHide the list
- Tue 16 JunDay 01
- Critical phpBB OAuth flaw lets hackers hijack any account01:30 · SecurityOnline · First report · This article, 1st of 1