A 10-year-old authentication bypass in phpBB lets attackers log in as any user, including administrators, using a single HTTP request. phpBB fixed the issue in version 3.3.17, while 4.x users are still advised to upgrade immediately because no safe 4.x release is available yet. #phpBB #Aikido #HackerOne
Keypoints
- The flaw affects phpBB versions 4.0.0-a2 and 3.3.16 and below.
- It was introduced into the codebase 10 years ago.
- Attackers can exploit it with one HTTP request and no special configuration.
- Admin access could expose private messages and allow site and account tampering.
- phpBB released a fix in 3.3.17, but no safe 4.x release is available yet.