[CVE-2026-48611] 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums

CVE

CVE-2026-48611

CVSS

9.8

Published

2026-06-10 00:00

Collected

2026-07-04 09:15

---
id: 2424
title: "[CVE-2026-48611] 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums"
cve: CVE-2026-48611
cvss: 9.8
severity: critical
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/phpbb-authentication-bypass-rce"
published_at: "2026-06-10 00:00"
tags: ["ai-security", "account-takeover", "authentication-bypass", "phpbb", "vulnerability", "forum", "ai-pentesting", "disclosure", "cve-2026-48611"]
phying_url: "https://phying.com/item/2424"
lang: en
---

# [CVE-2026-48611] 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums

## Summary

Aikido's AI pentesting tool found a critical pre-auth authentication bypass in phpBB, exploitable in default configurations. Fixed in 3.3.17; admins should upgrade immediately.

## Intelligence Metadata

- **Sources:** aikido.dev
- **CVE:** CVE-2026-48611
- **CVSS:** 9.8
- **Published:** 2026-06-10 00:00
- **Original:** https://www.aikido.dev/blog/phpbb-authentication-bypass-rce
- **Phying News:** https://phying.com/item/2424