phpBB forum fixes auth bypass bug lurking for a decade
phpBB has patched a decade-old auth bypass bug that could let attackers log in as any user, including admins.
Intelligence analysis by GPT-5.4 Mini
Researchers at Aikido reported a trivial one-request authentication bypass in phpBB that affected old 3.x and 4.x code. phpBB fixed the issue in 3.3.17, but 4.x users still need to move to master because no safe 4.x release exists yet.
phpBB had a hidden lock mistake that could let a stranger walk in as if they were the boss. The fix closes that door, but some newer test versions still need special handling.
Analysis
What happened
Aikido found an authentication bypass in phpBB on June 2 and reported it through the project’s HackerOne vulnerability disclosure program. phpBB responded quickly and fixed the bug on June 6 in version 3.3.17.
Scope of the flaw
According to Aikido, the issue had been present for about 10 years and affected the 3.x and 4.x release branches up to phpBB 3.3.16 and 4.0.0-a2. The researchers say it is easy to exploit, needs only a single HTTP request, and works in the default configuration without special setup or advanced knowledge.
Impact
If an attacker can bypass authentication, they can log in as any user, including administrators. That could let them read private messages, create or delete content and user accounts, impersonate staff, or deface the forum. Aikido also notes that picking targets is simple because forum member lists are public by default.
Limits and mitigation
Aikido says remote code execution is not possible because a separate password check still protects the Admin Control Panel. The company withheld technical details for now to give administrators time to patch, and it contacted operators of large phpBB forums directly.
Upgrade notes
The article says phpBB 3.3.17 fixes the issue for the 3.x line. For 4.x, there is no fix yet, so users on 4.0.0-a2 are told to upgrade to master. The update may break OAuth authentication because the OAuth redirect handler moved, though the report says that should be a simple fix in most cases.
Key points
- Aikido found a phpBB authentication bypass that could let attackers log in as any user, including admins.
- phpBB fixed the issue in version 3.3.17 after being notified through HackerOne.
- Aikido says the flaw existed for about 10 years and affects phpBB 3.x and 4.x releases up to 3.3.16 and 4.0.0-a2.
- The bug is described as trivial to exploit with one HTTP request and works in the default configuration.
- Remote code execution is said to be blocked by a separate password check in the Admin Control Panel.
phpBB moved quickly once the bug was reported, which should reduce exposure for forum operators who patch promptly. The researchers also withheld details and warned large forum admins directly, giving defenders time to update before a public write-up arrives.
Sites that do not patch right away could still be taken over, with attackers reading private messages or changing forum content. The 4.x branch is also not fully fixed yet, so users on that line have to take extra care and may face upgrade disruption.
