Critical phpBB Auth Bypass Flaw Unpatched for 10 Years Exposes Admin Accounts

Security researchers at application security firm Aikido have disclosed a severe authentication bypass vulnerability in phpBB, the widely used open-source forum platform, that has lurked undetected in the codebase for roughly a decade. The flaw, which has not yet been assigned a CVE identifier, allows an attacker to log in as any user on a vulnerable forum, including administrators, with nothing more than a single crafted HTTP request. It impacts phpBB versions 3.3.16 and below, as well as 4.0.0-a2 in the 4.x development branch. Aikido reported the bug to the phpBB team through its HackerOne Vulnerability Disclosure Program on June 2, and the maintainers shipped a fix in version 3.3.17 just four days later, on June 6.

According to Aikido's advisory, the vulnerability was introduced into phpBB's codebase approximately 10 years ago and has affected every release in the 3.x and 4.x branches up to the patched versions. A patch for the 4.x line is not yet available, so administrators running 4.0.0-a2 are advised to move to the master branch in the interim. The bug is exploitable in default configurations and requires no special knowledge or prior access, making it particularly dangerous at scale. Aikido notes that while remote code execution is not directly possible because a separate password check guards the Admin Control Panel, full administrative access still enables attackers to read private messages, create or modify user accounts, impersonate staff, and deface forum content. With phpBB's member list being public by default, identifying and targeting vulnerable installations is trivial. Operators concerned about exposure can run a privacy checkup on their public-facing endpoints to assess what information their forums may be leaking.

Forum administrators should upgrade to phpBB 3.3.17 immediately. One known side effect of the patch is that forums relying on OAuth authentication may break, because the OAuth redirect handler has been moved to a new location, though this is typically a straightforward configuration fix. Aikido is withholding full technical details for now to give administrators time to patch, and has also reached out directly to operators of large phpBB-based communities to warn them. Users who reuse credentials across multiple services should verify that their accounts have not appeared in known data exposures using an email breach checker, and should rotate any passwords shared between their forum account and other platforms, ideally after testing them against a password checker to ensure strength and uniqueness.