phpBB CVE-2026-48611

No special conditions - remote unauthenticated exploitation against default configurations of phpBB. The description explicitly states the flaw is exploitable even when OAuth is not configured or enabled, eliminating the most natural mitigation. Limiting factors are minimal: the phpBB instance must be network-reachable to the attacker and running a vulnerable version; no user interaction, no prior authentication, and no non-default settings are required.

The CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N indicates remote, network-reachable, low-complexity exploitation with no authentication and no user interaction, scoring 9.8 critical. This is amplified by the description's explicit statement that default installations are affected without any OAuth configuration, removing the most common mitigating prerequisite. No EPSS score, KEV listing, or public POC has been provided in the intelligence sources, so while the theoretical risk is severe, evidence of in-the-wild exploitation is absent - the only reference is a phpBB community advisory thread. Given phpBB's massive install base across hobby and community forums, this should be treated as a high-priority patch even without confirmed exploitation signals.

A remote attacker sends specially crafted requests to the OAuth authentication endpoints of a target phpBB forum, abusing the flawed authentication checks to associate or assume the identity of an existing account - including administrative accounts - without needing valid credentials. Because the flaw triggers on default installations regardless of OAuth configuration, any internet-reachable phpBB site is a candidate target. No public exploit identified at time of analysis, but the simplicity implied by AC:L suggests one could emerge quickly once technical details are disclosed.