CVE-2026-48611 AKAOMA CVE VULNERABILITIES / 3h Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

Back cve.akaoma.com

CVE-2026-48611 AKAOMA CVE VULNERABILITIES / 3h Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

cve.akaoma.com • June 12, 2026

Share: View original

9.8 /10 Critical Risk As a catastrophic security flaw, CVE-2026-48611 has severe implications, demanding immediate intervention.

As a catastrophic security flaw, CVE-2026-48611 has severe implications, demanding immediate intervention.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-48611 Vulnerability Allows OAuth Account Hijacking CVE-2026-48611 has been identified as a critical vulnerability due to improper authentication checks in OAuth implementations, allowing account hijacking even when OAuth is disabled. This flaw affects default installations of phpBB versions below 3.3.16, enabling unauthenticated attackers to gain unauthorized access to user accounts. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical nature. Currently, there is no evidence of public proof-of-concept or active exploitation. Security experts recommend applying the patch available via GitHub Advisory immediately or disabling OAuth functionality if not needed. Organizations should also audit account access logs for any signs of unauthorized activity. The vulnerability was published on June 12, 2026. 1 sources 79

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

CWE-287 - Improper Authentication