Executive brief
A security flaw in the phpBB forum software's login system could allow an attacker to hijack a user's account. By tricking a logged-in user into clicking a malicious link, an attacker can link the victim's forum profile to an account they control. This allows the attacker to gain full access to the victim's account, potentially exposing private messages and administrative controls.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the phpBB OAuth implementation due to improper verification of the 'state' parameter during the authentication flow. An attacker can exploit this by inducing a victim to initiate an OAuth handshake that completes using the attacker's credentials, leading to unauthorized account linking. This attack requires network connectivity, low-privileged attacker credentials, and user interaction from the victim. Successful exploitation results in a full account takeover by allowing the attacker to log in via the linked third-party provider. The issue is tracked as CWE-352.
Affected products
- phpBB phpBB
Timeline
- 2026-06-12: disclosed
- 2026-06-12: advisory