---
id: 2172
title: "[CVE-2026-48611] Authentication Bypass in the default configuration phpBB"
cve: CVE-2026-48611
severity: critical
vendor: "phpBB"
product: "phpBB"
affected_versions: "phpBB <= 3.3.16; fixed in 3.3.17"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/authentication-bypass-phpbb-technical-writeup"
published_at: "2026-07-04 00:00"
tags: ["ai-security", "featured", "account-takeover", "authentication-bypass", "phpbb", "web-security", "aikido", "vulnerability-disclosure", "oauth", "cve-2026-48611"]
phying_url: "https://phying.com/item/2172"
lang: en
---

# [CVE-2026-48611] Authentication Bypass in the default configuration phpBB

## Summary

CVE-2026-48611 allows an unauthenticated attacker to log in as an arbitrary phpBB user, including an administrator, with a single request on default configurations. phpBB fixed the critical issue in 3.3.17.

## Why it matters

A single unauthenticated request can impersonate any phpBB user, including administrators, on default configurations. Upgrading to phpBB 3.3.17 is urgent.

## Intelligence Metadata

- **Sources:** aikido.dev
- **CVE:** CVE-2026-48611
- **Vendor:** phpBB
- **Product:** phpBB
- **Affected versions:** phpBB <= 3.3.16; fixed in 3.3.17
- **Published:** 2026-07-04 00:00
- **Original:** https://www.aikido.dev/blog/authentication-bypass-phpbb-technical-writeup
- **Phying News:** https://phying.com/item/2172