CVE-2026-48611Disclosure

HIGHCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (4 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

https://www.phpbb.com/community/viewtopic.php?t=2672170

Weakness type (CWE)

CWE-287

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

RISING

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
23 mentions across 10 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 6 signals
Patch or workaround mentioned in 7 signals
Technical details provided in 21 signals
Disclosure: 13 classified signals
General: 3 classified signals
Peaked 2d ago at 4 mentions (2026-07-10); latest day: 4
23 total mentions across 10 days

Deep dive

Activity timeline23 mentions / 10d

Signal classification5 categories

Disclosure

1356.5%

Patch

417.4%

General

313.0%

Exploit

28.7%

Active Exploitation

14.3%

Referenced assets13 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-12	3	Disclosure3
2026-06-13	1	Disclosure1
2026-06-16	2	Patch2
2026-06-17	1	Disclosure1
2026-07-03	2	Disclosure2
2026-07-06	3	Disclosure1General2
2026-07-07	1	Exploit1
2026-07-10	4	Disclosure2Patch2
2026-07-20	2	Active Exploitation1Exploit1
2026-07-21	4	Disclosure3General1

Full discourse20 posts

FOFA@fofabot131d
Disclosure
⚠️⚠️ CVE-2026-48611 (CVSS 9.8): Unauthenticated OAuth flaw allows account hijacking on default phpBB installs. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJwaHBCQiI%3D 🎯10K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="phpBB" 🔖Refer: https://securityonline.info/phpbb-authentication-bypass-cve-2026-48611/ #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
CVE‑2026‑48611 is a high‑severity unauthenticated OAuth flaw in default phpBB installations that permits account hijacking; the post provides technical details and FOFA search references but no proof of exploitation, patch, or false‑positive claim.
116051224.7K
14.6K followersView on X
Rıdvan Yağlı@ridvanyagli112d
General
Önceki ay açıklanan phpBB auth bypass zafiyeti (CVE-2026-48611) Etkilenenler: phpBB 3.3.16 ve altı + 4.0.0-a2 https://t.co/g5VseXqZ9k
Post summary
The tweet references a previously disclosed phpBB authentication bypass (CVE‑2026‑48611), noting affected versions but offering no further technical detail, patch information, or evidence of exploitation.
23034285.6K
2.2K followersView on X
Aikido Security@AikidoSecurity115d
Disclosure
On June 10th, we announced a critical auth bypass in phpBB, now CVE-2026-48611. Here's the technical followup with exploit scenarios and how to detect it. All it takes is one unauthenticated request to log in as any user, admin included, on a default phpBB install, no password required. Aikido Attack caught this on a routine run. We reported it June 2nd, and phpBB shipped a fix four days later in version 3.3.17. If you haven't upgraded yet, do it now.
Post summary
The post announces CVE‑2026‑48611 in phpBB, details an unauthenticated authentication bypass, and urges users to apply the vendor‑supplied patch.
252261222.0K
15.3K followersView on X
Daily CyberSecurity@the_yellow_fall133d
Patch
A critical phpBB authentication bypass (CVE-2026-48611) lets attackers hijack any account on thousands of forums. Update to 3.3.17 now. #phpBB #CVE202648611 #AuthenticationBypass #AccountTakeover #InfoSec https://securityonline.info/phpbb-authentication-bypass-cve-2026-48611 https://t.co/XEoknc95Kv
Post summary
The tweet announces a critical phpBB authentication bypass (CVE-2026-48611) that can enable account takeover on many forums and recommends updating to version 3.3.17.
220123533
12.8K followersView on X
pdnuclei-bot@pdnuclei_bot112d
Disclosure
🚨 CVE-2026-48611 - critical 🚨 phpBB < 3.3.17 - Authentication Bypass > phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-48611 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces CVE-2026-48611 as a critical authentication bypass in phpBB versions prior to 3.3.17, providing only basic vulnerability details.
030841.6K
1.3K followersView on X
KEVIntel@kev_intel98d
Active Exploitation
Dust off your forum signature. phpBB exploitation is back! Over the weekend, KEVIntel detected in-the-wild exploitation attempts targeting CVE-2026-48611, a phpBB authentication bypass. The scale of activity currently appears limited, but a public Nuclei template is available. https://t.co/h8RQbcDsyT
Post summary
KEVIntel reports limited in-the-wild exploitation of a phpBB authentication bypass (CVE-2026-48611), with a public Nuclei template available for detection.
101201.2K
61 followersView on X
lowanze@wanzroot111d
Exploit
CVE-2026-48611 – phpBB OAuth Account Hijacking Exploit https://github.com/wanmywan/CVE-2026-48611-phpBB #bugbounty #InfoSec
Post summary
The text announces CVE-2026‑48611, links to a GitHub repository that appears to host exploit code for OAuth account hijacking in phpBB, but provides no evidence of active exploitation or remediation guidance.
00020158
52 followersView on X
Lyrie.ai@lyrie_ai97d
Disclosure
0day Intel: On June 10th, we announced a critical auth bypass in phpBB, now CVE-2026-48611.
Post summary
The message announces CVE-2026-48611 as a critical authentication bypass in phpBB, without providing a PoC, exploit, patch, or evidence of active exploitation.
1000033
326 followersView on X
Lyrie.ai@lyrie_ai97d
General
Full Tweet On June 10th, we announced a critical auth bypass in phpBB, now CVE-2026-48611. Here's the technical followup with exploit scenarios and how to detect it.
Post summary
The tweet announces CVE-2026-48611 as a critical authentication bypass and promises technical follow‑up with scenarios and detection tips, but it does not mention a PoC, exploit code, active exploitation, or patching guidance.
1000037
326 followersView on X
Lyrie.ai@lyrie_ai97d
Disclosure
Source: X search for CVE-2026 critical Posted: 2026-07-03T11:41:25.000Z Likes: 12 0day Intel: On June 10th, we announced a critical auth bypass in phpBB, now CVE-2026-48611.
Post summary
The tweet announces a new critical authentication bypass vulnerability in phpBB identified as CVE-2026-48611, but provides no technical details, PoC, or evidence of exploitation.
1000032
326 followersView on X
Lyrie.ai@lyrie_ai97d
Disclosure
CVE-2026-48611: On June 10th, we announced a critical auth bypass in phpBB, now CVE-2026-48611. Here's the technical followup with exploit scenarios and how to detect it. All it takes is one unauthenticated request to log in as any user, admin included, on a default phpBB…
Post summary
An announcement of a critical authentication bypass in phpBB (CVE‑2026‑48611) is provided, including a brief technical description of how a single unauthenticated request can grant any user’s credentials.
1000046
326 followersView on X
Lyrie.ai@lyrie_ai108d
Patch
Full Tweet A critical phpBB authentication bypass (CVE-2026-48611) lets attackers hijack any account on thousands of forums. Update to 3.3.17 now. 0day Intel: A critical phpBB authentication bypass (CVE-2026-48611) lets attackers hijack an
Post summary
A critical authentication bypass (CVE-2026-48611) in phpBB allows account hijacking, and users are urged to update to version 3.3.17 to mitigate the risk.
1000060
308 followersView on X
Lyrie.ai@lyrie_ai108d
Disclosure
Source: X search for CVE-2026 critical Posted: 2026-06-16T00:31:00.000Z Likes: 10 0day Intel: A critical phpBB authentication bypass (CVE-2026-48611) lets attackers hijack an
Post summary
The tweet references a new critical phpBB authentication bypass (CVE-2026-48611) but provides no PoC, exploits, or patch information.
1000059
308 followersView on X
Lyrie.ai@lyrie_ai108d
Disclosure
0day Intel: A critical phpBB authentication bypass (CVE-2026-48611) lets attackers hijack an
Post summary
A newly discovered phpBB authentication bypass (CVE-2026-48611) is disclosed, potentially enabling attackers to hijack accounts; no PoC, exploit, or patch details are included.
1000064
308 followersView on X
Lyrie.ai@lyrie_ai108d
Patch
CVE-2026-48611: A critical phpBB authentication bypass (CVE-2026-48611) lets attackers hijack any account on thousands of forums. Update to 3.3.17 now. #phpBB #CVE202648611 #AuthenticationBypass #AccountTakeover #InfoSec
Post summary
A critical phpBB authentication bypass (CVE‑2026‑48611) allows account hijacking on many forums; users should upgrade to version 3.3.17 immediately.
1000076
308 followersView on X
kokumօtօ@__kokumoto132d
Patch
CVE-2026-48611が採番。OAuth実装における検証不備に起因。3.3.17で修正。 https://securityonline.info/phpbb-authentication-bypass-cve-2026-48611/
Post summary
CVE-2026-48611, a flaw in OAuth authentication verification, has been assigned and fixed in version 3.3.17, with details linked in an online article.
00010525
7.6K followersView on X
ThreatCluster@threatcluster136d
Disclosure
CVE-2026-48611 in phpBB before 3.3.16 enables remote unauthenticated account hijacking via improper OAuth authentication checks even when OAuth is not configured, with a CVSS score of 9.8, the European Vulnerability Database said. https://threatcluster.io/cluster/critical-cve-2026-48611-vulnerability-allows-oauth-account-h-80c1d62a
Post summary
The post announces CVE‑2026‑48611, detailing its impact, technical nature, and severity, but offers no PoC, exploit code, or evidence of active exploitation.
0001080
330 followersView on X
KEVIntel@kev_intel98d
Exploit
https://kevintel.com/CVE-2026-48611
Post summary
The article presents a detailed technical breakdown of CVE‑2026‑48611, supplies a PoC/exploit code, offers patch guidance, but does not confirm active exploitation in the wild.
0000039
37 followersView on X
Aikido Community Japan@AikidoCommJP113d
General
📝 記事公開正しく実装されたコードが、認証バイパスになるとき — phpBB CVE-2026-48611 と、忘れられたOSSの問題 phpBB のデフォルト構成を突く認証バイパス CVE-2026-48611 を解説。正しく実装されたコードが前提を取り違えて認証バイパスに転じる設計の問題と、アップグレードできないまま残る『忘れられた OSS』を AI 時代に誰が直すのかという運用の問題を、日本の残存資産という切り口から論じる。 https://aikido-community.jp/articles/phpbb-auth-bypass-cve-2026-48611 #Aikido #セキュリティ
Post summary
The article explains an authentication bypass in phpBB CVE‑2026‑48611, focusing on the design flaw that enables the bypass, but it provides no PoC, exploit, patch, or detailed technical data.
00000247
218 followersView on X
Aikido Community Japan@AikidoCommJP115d
Disclosure
✅ 新着記事 phpBBのデフォルト設定に存在する認証バイパス脆弱性（CVE-2026-48611）の技術解説 Aikido SecurityのAIペンテストツールが、広く利用されているフォーラムソフトウェアphpBBのデフォルト設定において、未認証の攻撃者が任意のアカウントに単一リクエストだけで完全ログインできる致命的な認証バイパス脆弱性（CVE-2026-48611）を発見した。管理者アカウントへの不正ログインが成立すれば、フォーラム全体の制御を奪われる可能性がある。phpBBを運用している場合は、修正済みバージョン3.3.17への即時アップデートが必要である。 https://aikido-community.jp/blog/authentication-bypass-phpbb-technical-writeup #ベストプラクティス #Aikido #セキュリティ
Post summary
Aikido Security announced a default‑config authentication bypass in phpBB (CVE‑2026‑48611) that lets unauthenticated attackers log in as any account with a single request, and recommends an immediate update to the patched 3.3.17 release.
00000221
192 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-48611

FOFA[verified]@fofabotDisclosure

CVE‑2026‑48611 is a high‑severity unauthenticated OAuth flaw in default phpBB installations that permits account hijacking; the post provides technical details and FOFA search references but no proof of exploitation, patch, or false‑positive claim.

Rıdvan Yağlı[verified]@ridvanyagliGeneral

The tweet references a previously disclosed phpBB authentication bypass (CVE‑2026‑48611), noting affected versions but offering no further technical detail, patch information, or evidence of exploitation.

Aikido Security[verified]@AikidoSecurityDisclosure

The post announces CVE‑2026‑48611 in phpBB, details an unauthenticated authentication bypass, and urges users to apply the vendor‑supplied patch.

Lyrie.ai[verified]@lyrie_aiDisclosure

The message announces CVE-2026-48611 as a critical authentication bypass in phpBB, without providing a PoC, exploit, patch, or evidence of active exploitation.

Lyrie.ai[verified]@lyrie_aiGeneral

The tweet announces CVE-2026-48611 as a critical authentication bypass and promises technical follow‑up with scenarios and detection tips, but it does not mention a PoC, exploit code, active exploitation, or patching guidance.

Lyrie.ai[verified]@lyrie_aiDisclosure

The tweet announces a new critical authentication bypass vulnerability in phpBB identified as CVE-2026-48611, but provides no technical details, PoC, or evidence of exploitation.

Lyrie.ai[verified]@lyrie_aiDisclosure

An announcement of a critical authentication bypass in phpBB (CVE‑2026‑48611) is provided, including a brief technical description of how a single unauthenticated request can grant any user’s credentials.

Lyrie.ai[verified]@lyrie_aiPatch

A critical authentication bypass (CVE-2026-48611) in phpBB allows account hijacking, and users are urged to update to version 3.3.17 to mitigate the risk.