phpBB OAuth improper-authentication account hijack (admin) even when OAuth disabled; CVSS 9.8; fixed 3.3.17

CVE-2026-48611 / CVE-2026-48612: phpBB authentication bypass gives a session as any user from one unauthenticated request, plus an OAuth account-link CSRF

phpBB 3.3.17, released on 2026-06-06, fixes two authentication flaws disclosed by Pentest-Tools.com (Pentest-Tools.com, 2026-06-08). CVE-2026-48611 (CVSS 9.4 per Pentest-Tools) lets a single unauthenticated POST to the user control panel's login-link handler with auth_provider=apache route the login through phpBB's Apache provider, which checks only that the HTTP Basic username matches and that the password is non-empty, never comparing the password with the stored hash, and returns a valid session as any active user on default installations (Pentest-Tools.com, 2026-06-08). The CVE record, assigned by HackerOne as numbering authority, scores it CVSS 3.0 9.8 and describes improper authentication checks in phpBB's OAuth implementation that allow account hijacking even when OAuth is not configured or enabled (ENISA EUVD, 2026-06-12); heise reports the same 9.8 (heise online, 2026-06-15). A known username is enough, and a default board's public member list supplies it (Pentest-Tools.com, 2026-06-08). Sources disagree on whether the session also reaches the Administration Control Panel. Pentest-Tools first wrote that the panel's separate password prompt stops the attacker, then added on 2026-06-15 that an attacker can in fact directly access the panel after impersonating an administrator (Pentest-Tools.com, 2026-06-08). Aikido says a password check in front of the panel cannot be bypassed, which is why it rules out direct remote code execution even through the Extension Catalog (Aikido Security, 2026-06-10). Aikido reported the flaw to phpBB on 2026-06-02 and says it affects every version up to 3.3.16 and 4.0.0-a2 (Aikido Security, 2026-06-10), and heise reports that Aikido and Pentest-Tools' researcher found it independently (heise online, 2026-06-15).

CVE-2026-48612 (CVSS 8.3 per Pentest-Tools; 8.0 under CVSS 3.0 in its CVE record (ENISA EUVD, 2026-06-12), the score heise reports (heise online, 2026-06-15)) affects only boards where an administrator has enabled OAuth login with a Google, Facebook or Bitly provider. Missing OAuth state validation and a missing CSRF check on the account-link endpoint let an attacker bind their own identity-provider account to a logged-in victim who opens a crafted link, which gives the attacker a permanent OAuth login to the victim's account (Pentest-Tools.com, 2026-06-08). Pentest-Tools added proof-of-concept requests for both flaws to its write-up on 2026-07-04 (Pentest-Tools.com, 2026-06-08). Neither CVE is in CISA's KEV catalog as of 2026-09-29 (CISA KEV catalog, 2026-09-29).

Triage: the bypass works by forcing the Apache provider instead of the configured one (Pentest-Tools.com, 2026-06-08), so on a board that uses database authentication, a login request naming the Apache provider is the exploit path, not a misconfigured client.