The vulnerability is a Cross‑Site Request Forgery flaw in the OAuth implementation of phpBB that allows an attacker to manipulate the authentication flow so that a victim’s account is linked to an attacker‑controlled account. This misuse of the state parameter can enable the attacker to subsequently take over or hijack the victim’s account.

The flaw affects phpBB community software; specific affected versions were not disclosed in the advisory, so all current releases until a fixed version becomes available are potentially vulnerable.

The CVSS score of 8 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of an EPSS score does not guarantee low exploitation risk. The weakness is inferred to be exploitable via a CSRF attack vector that targets the OAuth login flow, which is a well‑known attack pattern for state verification failures.