Ability to completely disable authentication via stream.php and commented out module authentication code within it. http://victim//index.php?mod=admin&act=acl_enable_acl Authenticates correctly. http://victim//stream.php?mod=admin&act=acl_enable_acl Does not.