CVE-2026-48611

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.86% chance of exploitation in the next 30 days, 89th percentile

Nuclei

critical · CWE-287

Published

2026-06-12

Proof-of-concept exploits (3)

• wanmywan/CVE-2026-48611-phpBB0★ · 2026-07-07
• Ethicalgrey/phpBB-CVE-2026-486111★ · 2026-08-30
• Diznev/CVE-2026-48611-EXPLOIT

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48611.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2026-8732
• CVE-2026-4861
• CVE-2026-4862
• CVE-2026-4860
• CVE-2026-4868
• CVE-2026-48599