Critical phpBB Vulnerability Allows Account Hijacking via Single Request

Aikido.Dev

Critical phpBB Vulnerability Allows Account Hijacking via Single Request

First seen 10 Jun 2026, 10:17 UTC • •72.0

Article Content

1 / 7

Browse articles

ThreatCluster •June 11, 2026 at 09:28 UTC

•phpBB vulnerability allows account hijacking with a single unauthenticated request.
•All versions up to 3.3.16 and 4.0.0-alpha are affected; patch released on June 6, 2026.
•Attackers can access private messages and forum content, posing significant risks.

A critical vulnerability in phpBB forum software enables attackers to hijack any account, including administrators, with a single unauthenticated request. This flaw, tracked as PTT-2026-004, affects all versions up to 3.3.16 and the 4.0.0-alpha version. Discovered by Dan Stefan Alexandru, it was reported to phpBB on June 4, 2026. The vulnerability is rated 9.4 on the CVSS scale and allows attackers to obtain a valid session for any user by simply knowing their username. The attack is particularly concerning as it exposes private messages and content accessible to the compromised account. Although the Administration Control Panel remains secure, the risk of data exposure is significant. phpBB released a patch (version 3.3.17) on June 6, 2026, urging users to upgrade immediately. A secondary vulnerability, PTT-2026-005, affects OAuth logins and can lead to account takeovers if not mitigated. Administrators are advised to disable OAuth if they cannot upgrade promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 147d ago How this analysis works

Timeline

2026-06-04

Vulnerability reported to phpBB

Dan Stefan Alexandru disclosed the authentication bypass flaw to phpBB, affecting multiple versions.

Infosecurity-Magazine

2026-06-06

Patch released for phpBB

phpBB released version 3.3.17 to address the critical vulnerabilities, urging immediate upgrades.

Infosecurity-Magazine

2026-06-10

Critical vulnerability disclosed

Aikido Attack revealed a critical authentication bypass vulnerability in phpBB, leading to RCE.

More articles in this cluster (6)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Weakness (1)

CWE-287 - Improper Authentication

Malware (1)

Santy

Affected Platform (1)

PhpBB

Tool (1)

Aikido Attack

Relationships

Santy related to CWE-287 - Improper Authentication
Santy related to PhpBB
Santy related to Aikido Attack

Following this threat?

Track Santy in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…

Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…