Authentication bypass in phpBB's UCP login-link flow. ucp.php?mode=login_link loads includes/ucp/ucp_login_link.php which accepts an attacker-controlled auth_provider query/POST parameter and calls $provider_collection->get_provider($request->variable('auth_provider','')). By setting auth_provider=apache, the apache auth provider's login() method is invoked. The apache provider (phpbb/auth/provider/apache.php) reads PHP_AUTH_USER from the HTTP Basic Authorization header, checks it matches the submitted username, looks up the user in the database, and returns LOGIN_SUCCESS without ever validating the password. session_create() is then called for the target user. Default auth_method=db installations are vulnerable out of the box; OAuth is not required. An unauthenticated attacker can obtain a valid session as any known user including administrators.