Loading vulnerability…
Authentication Bypass in phpBB OAuth Login-Link Flow
CVE-2026-48611 is a critical improper authentication vulnerability in phpBB affecting all 3.3.x releases prior to 3.3.17. The flaw is reachable in the login-link workflow used to associate external identities with local accounts. Insufficient authentication validation in this flow allows attacker-controlled selection of an authentication provider and acceptance of a forged authentication context. Reported analyses describe broken OAuth state verification and a reachable code path that permits invocation of the Apache authentication provider from the login-link flow, even on default installations where OAuth has never been configured. Because that provider trusts externally supplied authenticated-user context and does not verify a local password in this scenario, phpBB can treat an unauthenticated request as a successful login for an arbitrary existing user. The issue can therefore result in full account hijacking, including administrator accounts, from a single unauthenticated request.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated remote attacker to bypass authentication and log in as any arbitrary phpBB user, including administrators. This enables complete account takeover, unauthorized access to private forum data, administrative control of the board when privileged accounts are targeted, modification of content and configuration, and potential follow-on compromise of the application environment through administrator-level actions. The vulnerability is broadly exposed because it affects default installations and remains reachable even when OAuth is not configured or enabled.
If you can’t patch tonight, do this now.
If immediate upgrading is not possible, exposure can only be reduced operationally, not eliminated. Closely monitor authentication and application logs for suspicious login-link activity and unexpected account logins, especially attempts involving the login-link flow and abnormal authentication-provider selection. Restrict administrative access, review active sessions, and rotate credentials for potentially exposed accounts after patching. However, disabling OAuth providers does not remove the vulnerable code path, so this should not be relied upon as an effective mitigation.
Patch, then assume compromise.
Upgrade phpBB to version 3.3.17 or later. The vendor states there is no workaround other than upgrading. After upgrading, administrators using OAuth integrations must update configured OAuth provider redirect URIs to the new format introduced by the fix; otherwise OAuth login functionality may break.
3 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.