CVE-2026-48611

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
phpBB	phpBB	>= 3.3.0, <= 3.3.16

References

https://www.phpbb.com/community/viewtopic.php?t=2672170

Timeline

Published: Jun 12, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-486128.0Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s a CVE-2026-486135.9SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, CVE-2026-486149.9An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resu CVE-2026-486157.5A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials CVE-2026-486169.3Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Prote CVE-2026-486178.2A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confide CVE-2026-486186.5A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypas CVE-2026-486197.5A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on CVE-2026-48628.8A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file CVE-2026-48677.5Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something th CVE-2026-48688.2GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 th CVE-2026-486818.1OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.