Skip to content
Critical CVE-2026-48611 Vulnerability Allows OAuth Account Hijacking

Critical CVE-2026-48611 Vulnerability Allows OAuth Account Hijacking

First seen 12 Jun 2026, 09:09 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 13, 2026 at 08:25 UTC
  • •CVE-2026-48611 is a critical vulnerability with a CVSS score of 9.8.
  • •It allows account hijacking through improper OAuth authentication checks.
  • •Immediate patching is recommended to mitigate risks associated with this flaw.

CVE-2026-48611 has been identified as a critical vulnerability due to improper authentication checks in OAuth implementations, allowing account hijacking even when OAuth is disabled. This flaw affects default installations of phpBB versions below 3.3.16, enabling unauthenticated attackers to gain unauthorized access to user accounts. The vulnerability has been assigned a CVSS score of 9.8, indicating its critical nature. Currently, there is no evidence of public proof-of-concept or active exploitation. Security experts recommend applying the patch available via GitHub Advisory immediately or disabling OAuth functionality if not needed. Organizations should also audit account access logs for any signs of unauthorized activity. The vulnerability was published on June 12, 2026.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 99d ago How this analysis works

Timeline

2026-06-12
CVE-2026-48611 published
CVE-2026-48611 details released, highlighting critical OAuth authentication flaws in phpBB.
Feedly
2026-06-12
Critical risk assessment issued
CVE-2026-48611 assessed as a catastrophic security flaw demanding immediate intervention.
cve.akaoma.com

More articles in this cluster (4)

Following this threat?

Track CVE-2026-48611 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3