The vulnerability arises from improper authentication checks in the OAuth implementation of phpBB, enabling attackers to hijack accounts even when OAuth is not configured or enabled. The flaw permits unauthorized access in default installations, potentially allowing attackers to impersonate users, access sensitive data, and possibly elevate privileges. The likely attack vector is remote exploitation through standard HTTP requests, though the CVE description does not explicitly state network requirements. The flaw is a typical instance of authentication bypass (CWE-287).

Affected systems include PHP based forums running phpBB with the default installation set‑up. No specific product version is listed, so any installation using the default authentication configuration is potentially vulnerable.

The severity score of 9.8 indicates a critical risk. The exploit probability metric is not available, but the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, an attacker can exploit the flaw remotely, without prior authentication, and with no prerequisites. The lack of a patch or workaround in the data suggests that only a future update or manual disabling of OAuth could mitigate the risk.