CVE-2026-65888 is a critical auth bypass in Gridbox's socialLogin method. An attacker who controls an OAuth identity provider can bypass the mapping layer entirely and log in as any user on the target Joomla site — including administrators. The CVSS 9.8 is appropriate: this isn't an opportunistic foothold, it's a surgical credential theft vector. The 0.00284 EPSS score likely reflects the narrow exploitation requirements rather than a scoring failure: social login must be configured on the target, and exploitation requires a functioning identity provider you control. This isn't a mass-scan vulnerability; it's a precision tool.
What matters practically: verify that Gridbox is at version 2.20.2 or later. If your site uses social login, audit the configuration — an attacker doesn't need to compromise your site first, they need you to have the feature enabled so they can abuse the trust boundary between the identity provider and your local user table. The real risk extends beyond the initial compromise. A compromised admin account can access extension management, update mechanisms, and in some Gridbox configurations, pivot to other sites managed through the same panel. That's the cascade that justifies the critical severity — not just "attacker can log in," but "attacker can own the site's extension supply chain."
Monitor for anomalous social login attempts, especially for admin-level accounts or from identity providers you don't recognize. If you've historically run Gridbox versions below 2.20.2, treat any prior admin sessions as potentially compromised — the vulnerability existed unpatched for the lifetime of those versions.