CVE-2026-486119.8CriticalCWE-287
phpBB vulnerability
Not in CISA KEV
3.9%probability of exploitation in the next 30 days
90th percentile
050100
Higher than 90% of scored CVEs
9.8CriticalCVSS 3.0
LowMediumHighCrit.
DescriptionNVD
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 16 Jun.
- Critical phpBB OAuth flaw lets hackers hijack any accountSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.