The flaw arises from improper authentication checks in phpBB’s OAuth implementation, which allows an attacker to bypass authentication even when OAuth is not enabled. Based on the description, it is inferred that the attacker does not need any prior authentication to trigger the bypass and can send standard HTTP requests to the OAuth endpoints. An attacker can request a new session token for any user and then perform actions such as reading private messages, posting content, and accessing privileged data. The vulnerability is a classic authentication bypass, classified as CWE‑287.

phpBB forum software that uses the default configuration, including installations that have the OAuth component present even if it is disabled, is vulnerable. Based on the description, it is inferred that any installation containing the OAuth module, regardless of whether OAuth is enabled, will process authentication checks that allow bypass. As the check runs regardless of OAuth being enabled, all such installations remain at risk until the fix is applied.

The CVSS score of 9.8 marks this flaw as critical, while the EPSS score of 4% indicates that exploitation is realistic but not yet widespread. The likely attack vector is an attacker sending crafted HTTP requests over the network to the OAuth endpoints, with no special privileges required. It is not listed in the CISA KEV catalog, meaning no publicly known exploits have been reported yet, but the high severity warrants immediate action.