ethicalgrey/phpbb-cve-2026-48611Automated PoC for CVE-2026-48611 — phpBB OAuth login_link authentication bypass
USE AT YOUR OWN RISK.
This tool is provided strictly for authorized security research, penetration testing, and educational purposes. Only run it against systems you own or have explicit, written permission to test.
The author is not responsible or liable for any illegal or unethical use of this tool, or for any consequences resulting from such use. All legal and ethical responsibility for how this tool is operated rests solely with the person running it — the author does not partake in, endorse, or condone unauthorized use of this software.
automated PoC for phpBB's OAuth login_link authentication bypass
phpBB published CVE-2026-48611 with a technical write-up of the bug, but no working automated exploit was publicly available anywhere except the payload details in Pentest-Tools.com's own advisory — everything else was manual, one-off testing. This fills that gap: a single script that detects a vulnerable phpBB install, locates its login panel, and runs the actual bypass end-to-end.
This vulnerability was discovered and responsibly disclosed by Dan Stefan Alexandru of the Pentest-Tools.com security research team, reported to phpBB on June 4, 2026. This repository is an independent, automated PoC built from the public advisory — it is not affiliated with Pentest-Tools.com or phpBB.
phpBB supports logging in through an external identity provider (OAuth) instead of a local password — Apache's own auth mechanism is one of the supported providers. The endpoint that handles this, ucp.php?mode=login_link&auth_provider=apache, takes the username straight out of the HTTP Authorization: Basic header and starts an authenticated session for that user.
The bug: it never actually checks the password half of that header. A normal login rejects you if the password is wrong. This one doesn't — it trusts whatever username you claim and logs you in as them regardless of what password value you send. Any registered username plus a made-up password is enough to get a fully authenticated session.
styles/prosilver/style.cfg, composer.json, styles/subsilver2/style.cfg, or feed.php, trying each in turn until one discloses a version string.ucp.php on its own if you only hand it a bare domain — bounded same-origin crawl first, then falls back to probing common install paths (forum/, board/, phpBB3/, etc.).--no-browser for faster plain-HTTP requests when the target isn't challenge-gated. Also tries to find a domain's real, non-Cloudflare origin IP (via crt.name certificate-transparency lookups + common admin/mail subdomain probing) and routes requests straight there when one is confirmed.login_link request, verifies the resulting session actually authenticated as the target user (not just a 200/302), and prints a ready-to-paste URL that loads the forum pre-authenticated as that user in any browser.git clone https://github.com/Ethicalgrey/phpBB-CVE-2026-48611.git
cd phpBB-CVE-2026-48611
chmod +x install.sh
./install.sh
install.sh is a one-time setup — it installs everything the script needs (requests, urllib3, playwright + its Chromium browser) straight into your user environment, no virtual environment to activate and no setup to repeat. Once it finishes, python3 CVE-2026-48611.py ... just works, every time, from any new terminal.
# single target, bare domain — finds ucp.php, detects version, prompts for a
# username if vulnerable
python3 CVE-2026-48611.py -u example.com
# same, but auto-discover a username from the public memberlist instead of
# typing one in
python3 CVE-2026-48611.py -u example.com --auto
# faster plain-HTTP mode, no Chromium — use when the target has no
# Cloudflare-style JS challenge in front of it
python3 CVE-2026-48611.py -u example.com --no-browser
# run the browser visibly (needed if a JS challenge requires a human click)
python3 CVE-2026-48611.py -u example.com --headed
# a list of hosts, one per line — each vulnerable host still prompts
# individually before the exploit runs
python3 CVE-2026-48611.py -l targets.txt
# skip TLS verification (self-signed / broken cert targets)
python3 CVE-2026-48611.py -u example.com -k
-u/--url and -l/--list are mutually exclusive. --auto only works with -u/--url — it's deliberately not supported in list mode, so a batch run never fires the exploit without a human confirming each target first.
--auto — skips the manual username prompt and pulls a real username straight off the target's public memberlist.php instead (skips staff-looking accounts like admin/moderator/founder in favor of an ordinary member, to keep a PoC run low-impact).-l targets.txt — run the whole detect-and-exploit flow across a list of hosts in one go; each vulnerable host still prompts individually before the exploit fires (or auto-picks a username with --auto), so nothing runs unattended against a target list.