Introduction
Broken OAuth state verification in phpBB lets any unauthenticated attacker hijack arbitrary user accounts, including administrators, on completely default installations where OAuth has never been configured. The flaw carries a CVSS 9.8 score and affects every phpBB 3.3.x release prior to 3.3.17. Aikido Security traced related authentication weaknesses in the codebase back to approximately 2014.
phpBB is one of the most widely deployed open-source forum platforms, and it runs community forums for millions of users worldwide. A volunteer development team maintains the software, and it is distributed freely under the GPL. Because it is so widely used across hobbyist communities, enterprise support forums, and educational institutions, this vulnerability has an outsized blast radius relative to the project's profile.
Technical Information
Vulnerability Classification
CVE-2026-48611 falls under CWE-287: Improper Authentication, which describes scenarios where a system "does not prove or insufficiently proves" that an identity claim is correct. It maps to OWASP Top 10:2025 category A07, Authentication Failures.
The CVSS v3.1 base vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the score is 9.8 (Critical). The components break down as follows:
| CVSS Component | Value | Meaning |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable remotely over the internet |
| Attack Complexity (AC) | Low | No specialized conditions required |
| Privileges Required (PR) | None | No authentication needed to exploit |
| User Interaction (UI) | None | No victim action required |
| Scope (S) | Unchanged | Impact confined to the vulnerable component |
| Confidentiality (C) | High | Full information disclosure |
| Integrity (I) | High | Complete system integrity compromise |
| Availability (A) | High | Complete denial of service possible |
Every impact dimension is rated High, since a successful exploit grants the attacker the full privileges of the hijacked account.
Root Cause: OAuth State Verification Failure
The flaw is in phpBB's OAuth implementation, specifically in how it handles the state parameter during the OAuth authentication flow. In a correctly implemented OAuth flow, the state parameter acts as a CSRF protection token. It binds the authorization request to the user session that started it, so the application can confirm that an authorization response it receives corresponds to a request the current user made.
In phpBB's implementation, this state verification is either missing or insufficient. An attacker can therefore craft an OAuth callback that phpBB accepts without validating its origin, and effectively bind their own authenticated OAuth identity to a victim's phpBB session.
The flaw is particularly dangerous because the vulnerable OAuth code paths remain active and accessible in the default phpBB installation, whether or not an administrator has configured any OAuth providers. A standard phpBB install that uses only database authentication still exposes these endpoints. Administrators who never enabled Google, Facebook, or any other OAuth provider have no reason to suspect their installation is at risk through an OAuth-related attack vector, yet the code paths are fully reachable.
Attack Flow
Dan Stefan Alexandru of Pentest-Tools.com discovered the vulnerability and documented it as PTT-2026-005, alongside a related bypass tracked as PTT-2026-004 (assigned CVE-2026-48612).
Two distinct but complementary attack methods were identified:
PTT-2026-005 (CVE-2026-48611): The attacker exploits the missing state verification to forge an OAuth callback. Because phpBB does not properly validate that the callback came from a legitimate authorization request tied to the current session, the application accepts the forged response. The attacker can then bind an OAuth identity they control to the victim's phpBB account.
PTT-2026-004 (CVE-2026-48612): A separate authentication bypass that, when chained with PTT-2026-005, enables complete account takeover without the victim's password. Together, the two flaws mean that any logged-in user who clicks a malicious link can have their account fully compromised.
Patching only one of the two CVEs leaves a residual attack path, so both must be patched at the same time.
Additional Vulnerabilities in the Same Release
phpBB 3.3.17 fixed four security issues in total:
| Security Issue | Description | Scope |
|---|---|---|
| CVE-2026-48611 | OAuth improper authentication / account hijacking | All phpBB 3.3.x prior to 3.3.17, default installations |
| CVE-2026-48612 | Authentication bypass (PTT-2026-004) | All phpBB 3.3.x prior to 3.3.17 |
| SECURITY-294 | ACP permission escalation | Requires ACP access context |
| SECURITY-296 | SQL injection in profile fields | Only affects boards updated from pre-3.3.8 that missed the 3.3.11 patch |
Post-Upgrade Configuration Requirement
After upgrading to 3.3.17, administrators must update the redirect URI in every configured OAuth provider to the new single-URI format. The architectural fix refactored the OAuth workflow to use dedicated controllers instead of the previous ucp.php routes. The new redirect URI format is:
https://{board_url}/app.php/user/oauth/authenticate/google
This single endpoint replaces the two old URIs. If administrators do not update their OAuth provider redirect URIs after upgrading, OAuth login will break.
Affected Systems and Versions
All phpBB 3.3.x versions prior to 3.3.17 are vulnerable. That includes every standard installation, whatever its authentication configuration, because the vulnerable OAuth code paths are active even when no OAuth providers have been configured.
Specifically:
- Vulnerable: phpBB 3.3.0 through 3.3.16 (inclusive), in default configuration
- Fixed: phpBB 3.3.17 ("Young Bertie"), released June 6, 2026
- Configuration dependency: None. The vulnerability does not require OAuth to be enabled or configured. Default installations that use database authentication are exposed.
The BeyondMachines advisory states plainly: "There is no workaround for these flaws. Update your phpBB installation to version 3.3.17."
Disabling OAuth providers in the phpBB admin panel does not eliminate the vulnerability.
Vendor Security History
phpBB has accumulated 67 published CVE records since 2005, and 33 of them have known public exploits. None currently appear in CISA's Known Exploited Vulnerabilities catalog, though this may reflect the catalog's scope rather than an absence of real-world exploitation of phpBB vulnerabilities.
Aikido Security's research found that related authentication bypass vulnerabilities have existed in the phpBB codebase since approximately 2014, so this class of flaw sat dormant for over a decade before it was discovered. The phpBB team has historically stated that they "take security very seriously," and it commissioned an external security audit for the phpBB 3.1 release. However, authentication weaknesses that lasted a decade raise questions about how often later security reviews took place and how deep they went.
On the positive side, the response to CVE-2026-48611 was fast. The vulnerability was reported through HackerOne on June 4, 2026, and phpBB 3.3.17 was released on June 6, 2026, two days from report to patch. The release credits multiple researchers, including UdinChan, Anteater (giant_anteater), Aikido Security, Dan Stefan Alexandru of Pentest-Tools.com, and Himanshu Anand.
References
- phpBB 3.3.17 Release Announcement
- CVE-2026-48611 on TheHackerWire
- CVE-2026-48611 on dbugs (Positive Technologies)
- Infosecurity Magazine: Critical phpBB Flaw Lets Attackers Hijack Any Account
- Pentest-Tools.com: phpBB Authentication Bypass Research
- Aikido Security: Critical phpBB Vulnerability Auth Bypass Since 2014
- BeyondMachines: Critical phpBB Vulnerabilities Allow Unauthenticated Account Takeover
- CWE-287: Improper Authentication
- OWASP Top 10:2025 A07 Authentication Failures
- phpBB Vulnerabilities Overview on RadicalNotion.AI
- Proofpoint: 2026 Vulnerability Exploitation in the Wild
- Pentest-Tools.com: phpBB Authentication Bypass Exploit Entry
