VulnerabilityPublished
phpBB forum fixes auth bypass bug lurking for a decade
Source Bleeping Computer
0
Fixed in 3.3.17 : patch affected systems soon.
Data as of 15 Jun 2026, 09:46 UTC
Severity
HighRated High by Threat Radar from the Bleeping Computer text
- Patch
- Available – fixed in 3.3.17
What to do
AI-suggested
A fix is available in phpBB version 3.3.17 for the 3.x branch. Administrators should upgrade immediately if running version 3.3.16 or below. Forum administrators should apply the patch promptly to prevent compromise. Note that the update may require adjustments to OAuth authentication configurations due to changes in the OAuth redirect handler location.
Description
A 10-year-old authentication bypass vulnerability discovered in the phpBB forum software allows an attacker to log in as any user, including administrators. [...]
References
Community reviews
Loading reviews…