Loading vulnerability…
CVE-2026-48611 is a critical improper authentication vulnerability in phpBB affecting all 3.3.x releases prior to 3.3.17. The flaw is reachable in the login-link workflow used to associate external identities with local accounts. Insufficient authentication validation in this flow allows attacker-controlled selection of an authentication provider and acceptance of a forged authentication context. Reported analyses describe broken OAuth state verification and a reachable code path that permits invocation of the Apache authentication provider from the login-link flow, even on default installations where OAuth has never been configured. Because that provider trusts externally supplied authenticated-user context and does not verify a local password in this scenario, phpBB can treat an unauthenticated request as a successful login for an arbitrary existing user. The issue can therefore result in full account hijacking, including administrator accounts, from a single unauthenticated request.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This is a small standalone exploit repository, not a Metasploit/Nuclei module. Its primary entry point, `CVE-2026-48611.py`, is a Python 3 command-line tool for alleged phpBB CVE-2026-48611 exploitation. It accepts either one URL or a target list, normalizes and crawls target sites to find phpBB `ucp.php` installations, then fingerprints phpBB versions using publicly reachable style configuration files, `composer.json`, and `feed.php`. Versions at or below 3.3.16 are flagged as vulnerable. For exploitation, the tool targets phpBB's Apache OAuth login-link flow at `ucp.php?mode=login_link&auth_provider=apache`. It constructs HTTP Basic credentials containing a selected registered username and an arbitrary password, relying on the claimed password-validation flaw to receive an authenticated session. It validates that authentication succeeded rather than treating an HTTP status code alone as success, then provides a reusable authenticated forum URL. Usernames may be entered interactively or discovered from `memberlist.php` with `--auto`; automatic selection avoids names containing administrator/moderator/founder-like markers. The script includes operational features beyond basic exploitation: optional plain-requests mode, optional insecure TLS handling, Chromium/Playwright browser fetching for JavaScript/Cloudflare-style challenges, bounded same-origin crawling, common phpBB installation-prefix probes, and Cloudflare-origin discovery. The latter downloads Cloudflare address ranges, queries `crt.name`, and resolves common potentially unproxied subdomains before routing requests where appropriate. `install.sh` is a Bash dependency installer for Python 3.8+, requests, urllib3, Playwright, and Playwright Chromium; `requirements.txt` lists those packages. The remaining files are a `.gitignore` and README documentation. No destructive behavior, persistence, reverse shell, or external command payload is evident; the impact is unauthorized authenticated web-session creation/account takeover.
This repository is a small standalone Python proof-of-concept exploit for a claimed phpBB authentication bypass tracked as CVE-2026-48611. The repository contains only two files: a README with usage notes and affected-version claims, and a single executable script, exploit.py, which is the clear entry point. The exploit logic is straightforward and operational rather than framework-based. It creates a requests session with TLS verification disabled and a hardcoded browser-like User-Agent. It first requests /index.php to obtain baseline guest cookies. It then sends a crafted POST request to /ucp.php with query parameters mode=login_link, auth_provider=apache, and login_link_poc=1, while also supplying an HTTP Basic Authorization header containing base64(username:x) and standard login form fields. After the POST, it inspects returned phpBB cookies, especially the phpbb3_*_u cookie, to determine whether the session now belongs to a real user instead of the anonymous user. If a non-anonymous session is obtained, it attempts to access /adm/index.php to verify admin-panel reachability. The exploit’s main capability is session acquisition for an arbitrary supplied username on a vulnerable phpBB target, followed by validation of administrative access if that username corresponds to an admin account. It does not deploy malware, shells, or post-exploitation tooling; instead, its output is the authenticated cookie set that can be reused manually in a browser. The README explicitly instructs the operator to align the User-Agent with the browser and replace phpBB cookie values in the browser to continue the hijacked session. Overall, this is a focused web exploit POC targeting phpBB authentication/session handling. It is not a detection-only script, and it contains no obvious destructive or fake behavior. Its success depends on a vulnerable phpBB deployment, knowledge of a valid username, and the target issuing usable phpBB session cookies.
This repository is a minimal single-file JavaScript proof of concept targeting phpBB authentication behavior. The only file, poc.js, defines a username ('test') and issues a browser fetch() request to the current site's /ucp.php endpoint with mode=login_link and auth_provider=apache. It sets an Authorization: Basic header using the chosen username and a dummy password, and also submits form fields login=1, login_username, and login_password. Comments indicate usernames may be enumerated from memberlist.php or memberlist.php?mode=team, and that auth_provider=ldap may also work in some cases. Structurally, this is not a full exploit toolkit or framework module; it is a compact browser-side PoC intended to be executed in the context of the target origin, likely as part of an XSS or manual browser-console test. Its purpose is to demonstrate abuse of phpBB external authentication/login-link handling to attempt unauthorized login or account access for a known username under vulnerable configuration.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authentication bypass vulnerability affecting phpBB versions prior to 3.3.17.
An improper authentication vulnerability in the OAuth implementation that can allow account hijacking and unauthorized access, including in default installations even when OAuth is not configured or enabled.
A critical improper authentication vulnerability in phpBB caused by broken or missing OAuth state verification, enabling unauthenticated account hijacking on default installations.
A critical authentication bypass vulnerability in phpBB's login-link flow that allows an unauthenticated attacker to select the apache auth provider and log in as any arbitrary user, including administrators, without a valid password.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.