Skip to content

Back to the catalog

10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums
aikido.devadvisory

10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums

Aikido Security discovered an unauthenticated authentication bypass in phpBB (versions up to 3.3.16 and 4.0.0-a2) that lets an attacker forge a valid session for any user via a single HTTP request, since the member list is public by default. Admin account takeover exposes full read/write/delete access, though a separate ACP password check blocks direct RCE. Fixed in phpBB 3.3.17, disclosed via HackerOne with a 4-day patch turnaround; technical exploit details withheld pending upgrade adoption.

TL;DR Unauthenticated session-forging auth bypass in phpBB ≤3.3.16/4.0.0-a2 allows admin account takeover; patched in 3.3.17.
Open original ↗
Document

What it is

An unauthenticated authentication bypass in phpBB forum software, found by Aikido's AI pentesting tool "Aikido Attack." A single unauthenticated HTTP request yields a valid session as any user. It affects all versions up to and including 3.3.16 and 4.0.0-a2, and was exploitable in the default configuration with no special knowledge required.

How it works

The page withholds technical details deliberately (a follow-up article is promised once admins have had time to upgrade). What it states: one unauthenticated HTTP request obtains a valid session for any user, and because the member list is public by default, choosing a target is trivial.

Preconditions / Affected

  • phpBB 3.3.16 and below, or 4.0.0-a2.
  • Default install (public member list) makes target selection trivial, but the bypass itself does not depend on it.

What to do

Upgrade paths differ by branch — this is the detail the summary does not carry:

  • 3.3.x users: upgrade to 3.3.17 (released June 6, 2026).
  • 4.x users: there is no safe 4.x release; the page instructs upgrading to master.

One breaking change to plan for: if OAuth authentication is enabled, the redirect URI handler has moved to:

/user/oauth/authenticate/...

Update any OAuth provider redirect-URI configuration accordingly. Aikido also asks readers to notify any phpBB instances they know of; the largest communities were privately notified before disclosure.

Caveats

  • RCE is not directly possible, even on the latest version with the Extension Catalog, because a separate password check in front of the Admin Control Panel (ACP) cannot be bypassed. Impact is capped at account takeover — for an admin account, full read/write/delete across the forum and leakage of any private conversation.
  • Technical exploit details are intentionally held back for now, so you cannot build a detection from this page. Reported to phpBB's HackerOne VDP on June 2, 2026 (triaged in 9 minutes); patch out June 6.

Technologies named here

Threat actors named here

Related in AppSec