The flaw is caused by inadequate authentication checks in phpBB's OAuth feature, allowing an attacker to acquire a user session even when the OAuth component is not configured or actively enabled. This authentication bypass (CWE-287) lets an attacker impersonate any forum account, read private messages, modify posts, depending on the target account's role. The vulnerability can be triggered by sending crafted HTTP requests to the application.

Any phpBB forum running a default installation with OAuth not disabled is at risk. No specific affected versions are documented—any release that has not been patched is potentially vulnerable.

The vulnerability's severity is reflected by a CVSS score of 9.8, indicating a critical risk. The EPSS score of 3% suggests that, while the flaw is unlikely to be widely attacked yet, the possibility of exploitation remains. No entry in CISA KEV means it has not yet been observed in the wild, but the lack of a public exploit does not reduce its danger. An attacker can exploit the issue remotely via ordinary HTTP traffic, with no need for special permissions or elevated credentials.