CVE-2026-48612

Published: Jun 12, 2026Modified: Jun 12, 2026Deferred

8.0

Vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Exploitability: 1.3 / Impact: 6.0

Source: support@hackerone.com (Secondary)

Description

Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an attacker-controlled account. This can result in unauthorized account linking and potential account takeover.

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (1)

https://www.phpbb.com/community/viewtopic.php?t=2672170

Source: support@hackerone.com

Timeline

No history available yet.