phpBB Fixes Decade-Old Authentication Bypass Affecting Forum Accounts

Summary

Aikido found a decade-old phpBB authentication bypass that can let attackers log in as any user with one HTTP request. phpBB fixed 3.x in 3.3.17; affected 4.x builds have no safe release yet.

Key points

• The flaw affects phpBB 3.3.16 and earlier and 4.0.0-a2; Aikido says it was introduced about 10 years ago.
• Attackers can exploit it with a single HTTP request, even on default settings, to log in as any user.
• Administrator access could expose private messages and enable content or account tampering, staff impersonation, or forum defacement.
• Aikido says remote code execution is not possible because a separate password check protects the Admin Control Panel.
• phpBB fixed the 3.x issue in version 3.3.17; no safe 4.x release is available yet, and users are advised to upgrade to master.
• The update may break OAuth authentication on some forums because the OAuth redirect handler moved.

MITRE ATT&CK

Products