## https://sploitus.com/exploit?id=73D790FA-1413-5E4C-A008-7FFE6E2DCE29
**USE AT YOUR OWN RISK.**
**This tool is provided strictly for authorized security research, penetration testing, and educational purposes. Only run it against systems you own or have explicit, written permission to test.**
**The author is not responsible or liable for any illegal or unethical use of this tool, or for any consequences resulting from such use. All legal and ethical responsibility for how this tool is operated rests solely with the person running it — the author does not partake in, endorse, or condone unauthorized use of this software.**
---
# phpBB-CVE-2026-48611
**automated PoC for phpBB's OAuth `login_link` authentication bypass**
phpBB published CVE-2026-48611 with a technical write-up of the bug, but no working automated exploit was publicly available anywhere except the payload details in [Pentest-Tools.com's own advisory](https://pentest-tools.com) — everything else was manual, one-off testing. This fills that gap: a single script that detects a vulnerable phpBB install, locates its login panel, and runs the actual bypass end-to-end.
## Credit
This vulnerability was discovered and responsibly disclosed by **Dan Stefan Alexandru** of the **Pentest-Tools.com** security research team, reported to phpBB on **June 4, 2026**. This repository is an independent, automated PoC built from the public advisory — it is not affiliated with Pentest-Tools.com or phpBB.
## How the vulnerability works (in simple terms)
phpBB supports logging in through an external identity provider (OAuth) instead of a local password — Apache's own auth mechanism is one of the supported providers. The endpoint that handles this, `ucp.php?mode=login_link&auth_provider=apache`, takes the username straight out of the HTTP `Authorization: Basic` header and starts an authenticated session for that user.
The bug: **it never actually checks the password half of that header.** A normal login rejects you if the password is wrong. This one doesn't — it trusts whatever username you claim and logs you in as them regardless of what password value you send. Any registered username plus a made-up password is enough to get a fully authenticated session.
- **Affected:** phpBB 3.3.0 – 3.3.16
- **Fixed in:** 3.3.17 (released 2026-06-06)
- **Impact:** full account takeover of any known username, no password required
## What the tool actually does
- **Detects the phpBB version** without authentication — reads `styles/prosilver/style.cfg`, `composer.json`, `styles/subsilver2/style.cfg`, or `feed.php`, trying each in turn until one discloses a version string.
- **Finds `ucp.php` on its own** if you only hand it a bare domain — bounded same-origin crawl first, then falls back to probing common install paths (`forum/`, `board/`, `phpBB3/`, etc.).
- **Cloudflare-aware** — default fetch mode runs through real Chromium (Playwright) so JS challenges get a chance to clear; add `--no-browser` for faster plain-HTTP requests when the target isn't challenge-gated. Also tries to find a domain's real, non-Cloudflare origin IP (via `crt.name` certificate-transparency lookups + common admin/mail subdomain probing) and routes requests straight there when one is confirmed.
- **Runs the actual bypass** once a vulnerable version is confirmed — sends the crafted `login_link` request, verifies the resulting session actually authenticated as the target user (not just a 200/302), and prints a ready-to-paste URL that loads the forum pre-authenticated as that user in any browser.
- **`--auto`** — skips the manual username prompt and pulls a real username straight off the target's public `memberlist.php` instead (skips staff-looking accounts like admin/moderator/founder in favor of an ordinary member, to keep a PoC run low-impact).
- **`-l targets.txt`** — run the whole detect-and-exploit flow across a list of hosts in one go; each vulnerable host still prompts individually before the exploit fires (or auto-picks a username with `--auto`), so nothing runs unattended against a target list.
## Install
```bash
git clone https://github.com/Ethicalgrey/phpBB-CVE-2026-48611.git
cd phpBB-CVE-2026-48611
chmod +x install.sh
./install.sh
```
`install.sh` is a one-time setup — it installs everything the script needs (`requests`, `urllib3`, `playwright` + its Chromium browser) straight into your user environment, no virtual environment to activate and no setup to repeat. Once it finishes, `python3 CVE-2026-48611.py ...` just works, every time, from any new terminal.
## Usage
```bash
# single target, bare domain — finds ucp.php, detects version, prompts for a
# username if vulnerable
python3 CVE-2026-48611.py -u example.com
# same, but auto-discover a username from the public memberlist instead of
# typing one in
python3 CVE-2026-48611.py -u example.com --auto
# faster plain-HTTP mode, no Chromium — use when the target has no
# Cloudflare-style JS challenge in front of it
python3 CVE-2026-48611.py -u example.com --no-browser
# run the browser visibly (needed if a JS challenge requires a human click)
python3 CVE-2026-48611.py -u example.com --headed
# a list of hosts, one per line — each vulnerable host still prompts
# individually before the exploit runs
python3 CVE-2026-48611.py -l targets.txt
# skip TLS verification (self-signed / broken cert targets)
python3 CVE-2026-48611.py -u example.com -k
```
`-u/--url` and `-l/--list` are mutually exclusive. `--auto` only works with `-u/--url` — it's deliberately not supported in list mode, so a batch run never fires the exploit without a human confirming each target first.