EUVD-2026-36375
GHSA-24pr-8ggp-h88c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms remote unauthenticated account hijacking on default installs with no user interaction, yielding full C/I/A impact on the compromised account context.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.
Articles & Coverage 1
AnalysisAI
Account hijacking in phpBB is possible due to improper authentication checks in the OAuth implementation, affecting default installations even when OAuth is not configured or enabled. Remote unauthenticated attackers can gain unauthorized access to arbitrary accounts on the forum platform, with no public exploit identified at time of analysis despite the critical 9.8 CVSS score.
Technical ContextAI
phpBB is a widely deployed open-source PHP-based forum software, identified by CPE cpe:2.3:a:phpbb:phpbb. The vulnerability is rooted in CWE-287 (Improper Authentication), specifically within the OAuth authentication flow. OAuth is an authorization delegation protocol that allows third-party providers (Google, Facebook, etc.) to authenticate users, but here the integration logic fails to properly validate authentication state and can be abused as an account takeover path even on installations that never enabled OAuth login providers.
RemediationAI
Patch available per vendor advisory - administrators should consult the phpBB community advisory at https://www.phpbb.com/community/viewtopic.php?t=2672170 and upgrade to the fixed release identified there as soon as practical, since no exact fix version was provided in the available intelligence. As a compensating control until patching, administrators can place the forum behind authenticated access (HTTP basic auth or VPN) for trusted users only, or block external requests to the OAuth login endpoints via web server rewrite rules (which will break any legitimate OAuth logins if enabled). Monitoring authentication logs for unexpected account access and forcing a global password reset post-patch is recommended given the account hijacking impact.
phpBB contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by e
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Inject
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote A
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in
Host header injection in phpBB versions 3.0.0 through 3.3.15 enables password reset link poisoning when force_server_var
Account takeover in phpBB via OAuth state-verification flaw enables remote attackers to link a victim's forum account to
The fulltext search component in phpBB before 3.2.6 allows Denial of Service. Rated high severity (CVSS 7.5), this vulne
Privilege escalation in phpBB allows an authenticated administrator with limited rights to grant themselves permissions
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the fo
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. Rated medium severity (CVSS 6.5), this vuln
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of G
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10.php of the component Smiley P
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today