EUVD-2026-36380
GHSA-575v-33q9-fpgm
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Attacker needs no phpBB credentials (PR:N) but must win an OAuth state race (AC:H) and trick a logged-in victim into clicking (UI:R); takeover yields full C/I but no direct availability loss.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an attacker-controlled account. This can result in unauthorized account linking and potential account takeover.
AnalysisAI
Account takeover in phpBB via OAuth state-verification flaw enables remote attackers to link a victim's forum account to an attacker-controlled identity provider account. Successful exploitation requires the victim to click an attacker-crafted link while authenticated, after which the attacker can authenticate as the victim through the linked external provider. No public exploit identified at time of analysis, but a vendor community advisory has been published.
Technical ContextAI
phpBB is a widely deployed open-source PHP forum platform whose OAuth subsystem supports linking external identity providers (Google, Facebook, etc.) to local forum accounts. The root cause maps to CWE-352 (Cross-Site Request Forgery): the OAuth flow does not properly validate the 'state' parameter that is supposed to bind an authorization response to the user-initiated request. Because the state token is the standard OAuth defense against cross-site request forgery on the callback endpoint, missing or weak verification allows an attacker to deliver a pre-initiated authorization code to a victim's session, causing the callback handler to bind the attacker's external identity to the victim's phpBB account. The affected component is identified by CPE cpe:2.3:a:phpbb:phpbb covering the OAuth account-linking handlers.
RemediationAI
Patch availability is indicated by the vendor advisory at https://www.phpbb.com/community/viewtopic.php?t=2672170, but the exact fixed version is not present in the supplied data - administrators should consult that thread and upgrade to the patched release noted there (Patch available per vendor advisory). As a compensating control until the upgrade is applied, administrators can disable OAuth authentication providers in the ACP under Authentication settings, which removes the vulnerable code path at the cost of breaking social-login for legitimate users; alternatively, instruct users not to click external links while logged into the forum and educate moderators/admins specifically, since takeover of a privileged account is the highest-impact scenario.
Account hijacking in phpBB is possible due to improper authentication checks in the OAuth implementation, affecting defa
phpBB contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by e
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Inject
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote A
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in
Host header injection in phpBB versions 3.0.0 through 3.3.15 enables password reset link poisoning when force_server_var
The fulltext search component in phpBB before 3.2.6 allows Denial of Service. Rated high severity (CVSS 7.5), this vulne
Privilege escalation in phpBB allows an authenticated administrator with limited rights to grant themselves permissions
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the fo
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. Rated medium severity (CVSS 6.5), this vuln
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of G
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10.php of the component Smiley P
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today