phpBB Authentication Bypass Exposes Admin Accounts and Potential RCE

phpBB released fixes for a critical authentication bypass flaw that lets an unauthenticated attacker obtain a valid session as any user, including administrators, by abusing the login flow and HTTP authentication handling. The issue affects phpBB versions through 3.3.16 and 4.0.0-a2, and stems from trust in the PHP_AUTH_USER value when Apache-based authentication is enabled. Reports describe attackers triggering the vulnerable path with crafted requests using login_link and auth_provider=apache, causing phpBB to treat supplied credentials as authenticated under affected configurations.

Researchers said compromise of an administrator account can lead to remote code execution and full system takeover in current phpBB deployments, turning the authentication flaw into a critical risk. phpBB addressed the bug in 3.3.17 and advised users of 4.0.0-a2 to move to the development master branch because no fixed 4.x release was yet available; public reporting also noted the weakness had existed since 2014 and included proof-of-concept request patterns showing how a forged login could be performed and a session retained.