# CVE-2026-48612: phpBB account takeover via improper OAuth state verification

Source: https://junglewise.ai/threats/cve-2026-48612-phpbb-account-takeover-via-improper-oauth-state-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-48612 · Severity: high · CVSS 8 · Published 2026-06-12

A security flaw in the phpBB forum software's login system could allow an attacker to hijack a user's account. By tricking a logged-in user into clicking a malicious link, an attacker can link the victim's forum profile to an account they control. This allows the attacker to gain full access to the victim's account, potentially exposing private messages and administrative controls.

## Quick answers

**Is CVE-2026-48612 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48612 being exploited in the wild.

**How severe is CVE-2026-48612?** High severity, with a CVSS score of 8, published 12 June 2026.

**Which products and versions are affected?** phpBB phpBB.

**Is there a fix for CVE-2026-48612?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48612 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48612?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the phpBB OAuth implementation due to improper verification of the 'state' parameter during the authentication flow. An attacker can exploit this by inducing a victim to initiate an OAuth handshake that completes using the attacker's credentials, leading to unauthorized account linking. This attack requires network connectivity, low-privileged attacker credentials, and user interaction from the victim. Successful exploitation results in a full account takeover by allowing the attacker to log in via the linked third-party provider. The issue is tracked as CWE-352.

## Affected products

- phpBB phpBB

## Timeline

- 2026-06-12: disclosed
- 2026-06-12: advisory

## References

- [https://www.phpbb.com/community/viewtopic.php?t=2672170](https://www.phpbb.com/community/viewtopic.php?t=2672170)