EUVD-2026-36380
GHSA-575v-33q9-fpgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker initiates OAuth flow with own IdP account
-
DeliveryCraft malicious callback link with attacker's authorization code
-
ExploitDeliver link to logged-in victim (phish, forum PM)
-
InstallVictim's browser hits phpBB OAuth callback
-
C2State verification bypassed, accounts linked
-
ExecuteAttacker logs into phpBB via social provider
-
ImpactFull takeover of victim's forum identity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the phpBB instance has an OAuth authentication provider enabled and configured (Google, Facebook, or similar social login), and that the victim is logged into the forum and clicks an attacker-supplied link while that session is active - both reflected in the CVSS metrics PR:L (victim must be authenticated) and UI:R (click required). The attacker must also successfully complete an OAuth authorization flow at the external provider with attacker-controlled credentials and time the callback against the victim's session, which corresponds to the AC:H rating. Forums with OAuth/social-login disabled in the ACP are not exploitable via this flaw. |
| Impact | The CVSS 3.0 score of 8.0 (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) reflects a high-impact, scope-changed CSRF requiring some preconditions: low privileges (a logged-in victim session), user interaction (clicking a link), and high attack complexity (winning the OAuth flow race or coercing the right click). EPSS and KEV signals were not provided in the input, so widespread exploitation cannot be confirmed; the absence of KEV listing combined with no public exploit identified at time of analysis suggests this is a serious but not yet weaponized issue. The CVSS PR:L assumption that the victim must be authenticated is consistent with the description's emphasis on linking an existing account, but defenders should note the S:C (scope change) and C/I/A:H ratings imply full takeover of the victim's identity once linking succeeds, which on a forum admin account could cascade to full board compromise. |
| Exploit ScenarioDerived | An attacker initiates an OAuth authorization request at an identity provider using their own account, captures the resulting authorization code or pre-seeded state, and lures a logged-in phpBB user (typically an administrator) into clicking a crafted callback URL on the target forum. The phpBB OAuth handler accepts the response without correctly verifying that the state parameter belongs to the victim's session and links the attacker's external identity to the victim's forum account, after which the attacker logs in via the social provider and assumes the victim's identity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Account takeover in phpBB via OAuth state-verification flaw enables remote attackers to link a victim's forum account to an attacker-controlled identity provider account. Successful exploitation requires the victim to click an attacker-crafted link while authenticated, after which the attacker can authenticate as the victim through the linked external provider. No public exploit identified at time of analysis, but a vendor community advisory has been published.
RemediationAI
Patch availability is indicated by the vendor advisory at https://www.phpbb.com/community/viewtopic.php?t=2672170, but the exact fixed version is not present in the supplied data - administrators should consult that thread and upgrade to the patched release noted there (Patch available per vendor advisory). As a compensating control until the upgrade is applied, administrators can disable OAuth authentication providers in the ACP under Authentication settings, which removes the vulnerable code path at the cost of breaking social-login for legitimate users; alternatively, instruct users not to click external links while logged into the forum and educate moderators/admins specifically, since takeover of a privileged account is the highest-impact scenario.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
phpBB is a widely deployed open-source PHP forum platform whose OAuth subsystem supports linking external identity providers (Google, Facebook, etc.) to local forum accounts. The root cause maps to CWE-352 (Cross-Site Request Forgery): the OAuth flow does not properly validate the 'state' parameter that is supposed to bind an authorization response to the user-initiated request. Because the state token is the standard OAuth defense against cross-site request forgery on the callback endpoint, missing or weak verification allows an attacker to deliver a pre-initiated authorization code to a victim's session, causing the callback handler to bind the attacker's external identity to the victim's phpBB account. The affected component is identified by CPE cpe:2.3:a:phpbb:phpbb covering the OAuth account-linking handlers.
Know when Phpbb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Attacker needs no phpBB credentials (PR:N) but must win an OAuth state race (AC:H) and trick a logged-in victim into clicking (UI:R); takeover yields full C/I but no direct availability loss.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an attacker-controlled account. This can result in unauthorized account linking and potential account takeover.
Executive ViewAI
A critical account takeover flaw in phpBB's OAuth authentication module allows attackers to compromise user accounts by deceiving victims into linking their forum credentials to attacker-controlled identity providers. Organizations operating phpBB forums face direct threats to user account security, unauthorized access to member data, and erosion of platform integrity. Account compromise could enable impersonation, data theft, and lateral movement within forum communities.
No vendor-released patch identified at time of analysis. Interim mitigations: disable OAuth third-party identity provider integrations if not operationally required; implement mandatory re-authentication before any account linking operation; require administrative approval for new identity provider account links; enforce enhanced audit logging on all authentication and account-linking events; restrict phpBB administrative account access to principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Related Vulnerabilities in phpBB OAuth Authentication and SQL Injection Flaws
View all 3Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Inject
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote A
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in
Reflected cross-site scripting in phpBB's registration module allows an unauthenticated remote attacker to execute scrip
Host header injection in phpBB versions 3.0.0 through 3.3.15 enables password reset link poisoning when force_server_var
The fulltext search component in phpBB before 3.2.6 allows Denial of Service. Rated high severity (CVSS 7.5), this vulne
Privilege escalation in phpBB allows an authenticated administrator with limited rights to grant themselves permissions
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the fo
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. Rated medium severity (CVSS 6.5), this vuln
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of G
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10.php of the component Smiley P
Exploit-DB