phpBB forum fixes auth bypass bug lurking for a decade

A decade-old authentication bypass in phpBB (affecting 3.x up to 3.3.16 and 4.0.0-a2) allows trivial account takeover — including administrator accounts — via a single HTTP request; phpBB released a fix in 3.3.17 for the 3.x branch while 4.x remains without a safe release. Exploitation requires no special configuration, could enable full forum administration (view private messages, modify accounts/content), and researchers temporarily withheld technical details to allow admins to patch.