IFrame is not a really good choice when it comes to passing passwords - itt would be in the plain view of anyone that knows anything about HTML... Although there are scenarios where one could advocate such usage, as a Core module we can not provide this functionality as it is available to any person out there.

Having said that, what do you mean - "i add dotnetnuke forum url into my iframe" ? Is it a DotNetNuke Forum module you are adding in an IFrame?  Or just some forum software you want to run inside the DNN?

there are plenty of good forum modules out there, besides Core module - Active Forums, Presstopia Forum, etc. Check them out before deciding on an unconventional architecture - there are many benefits in sticking to the DNN framework modules - security isn't the least of them.

it doesn't matter whether you use a link in text/HTML module or an iFrame module, there is always a risk in calling a different address with login credentials included. You can simply hash or encrypt both data, but anyone, who gets access to the url (Man in the middle attack) can use it the same way. You can include a time stamp in the encryption and accept data only, if not more than a minute has passed, since the parameters have been encrypted, but this requires both server clock to be in sync. And all encryption requires custom logic on both sides.