PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-48611] Authentication Bypass in the default configuration phpBB

aikido.dev | vulnerability | Critical | CVE-2026-48611 | #ai-security | #featured | #account-takeover | #authentication-bypass | #phpbb | #web-security | #aikido | #vulnerability-disclosure | #oauth | #cve-2026-48611
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2026-48611 allows an unauthenticated attacker to log in as an arbitrary phpBB user, including an administrator, with a single request on default configurations. phpBB fixed the critical issue in 3.3.17.

Why it matters

A single unauthenticated request can impersonate any phpBB user, including administrators, on default configurations. Upgrading to phpBB 3.3.17 is urgent.
CVE
CVE-2026-48611
Vendor
phpBB
Product
phpBB
Affected versions
phpBB <= 3.3.16; fixed in 3.3.17
Published
Collected

Related coverage

Critical · vulnerability · aikido.dev
10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums
Aikido's AI pentesting tool found a critical pre-auth authentication bypass in phpBB, exploitable in default configurations. Fixed in 3.3.17; admins should upgrade immediately.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
blog · yeswehack.com
‘I’m not the kind of person to rely on tooling’: Sn0rkY shares his Bug Bounty story and top tips
French hacker Sn0rkY shares his Bug Bounty methodology, views on AI tooling and advice for hunters in this YesWeHack interview.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
research · vercel.com
Security boundaries in agentic architectures
A framework for drawing security boundaries in agentic architectures. Most agents run with zero isolation between the agent and the code it generates. Learn where to draw the boundaries, from secret injection to full application sandboxing.
Back