CVE-2026-48612

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-06-12

Last updated on: 2026-06-17

Assigner: HackerOne

Description

Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an attacker-controlled account. This can result in unauthorized account linking and potential account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-17

Generated

2026-10-11

AI Q&A

2026-06-12

EPSS Evaluated

2026-10-09

NVD

CVE-2026-48612

EUVD

EUVD-2026-36380

Affected Vendors & Products

Vendor	Product	Version / Range
phpBB	phpBB	3.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper state verification in the OAuth implementation. An attacker can exploit this flaw to manipulate the authentication flow, causing a victim's account to be linked to an attacker-controlled account.

As a result, unauthorized account linking can occur, which may lead to potential account takeover.

Impact Analysis

The vulnerability can lead to unauthorized linking of your account to an attacker-controlled account.

This unauthorized linking can result in an attacker gaining control over your account, potentially leading to account takeover.

Compliance Impact

This vulnerability allows an attacker to manipulate the authentication flow and link a victim’s account to an attacker-controlled account, potentially leading to unauthorized account takeover.

Such unauthorized access and account takeover can result in exposure or misuse of personal or sensitive data, which may violate compliance requirements under standards like GDPR and HIPAA that mandate protection of user data and secure authentication mechanisms.

Hi! I’m here to help you understand CVE-2026-48612. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70