A critical authentication bypass vulnerability (CVE-2026-48611) was discovered in phpBB's default configuration by Aikido Security's AI pentest agents. The flaw exists in the login-link feature used for OAuth account linking. By supplying `auth_provider=apache` as a query parameter, an attacker can trigger phpBB's Apache authentication provider, which trusts the Basic Auth header username without verifying the password. A single unauthenticated POST request is enough to log in as any user, including administrators. The vulnerability was patched in phpBB 3.3.17 four days after disclosure. The post includes a full proof-of-concept HTTP request, JavaScript exploit snippet, and indicators of compromise for detecting exploitation in server logs.
