PT-2026-36770 · Phpbb · Phpbb

Published 2026-05-04 · Updated 2026-05-29 · CVE-2026-29199

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions phpBB versions prior to 3.3.16

Description Host Header Injection occurs when force server vars is disabled, allowing the server's hostname to be extracted from the HTTP Host header to generate password reset link URLs. An attacker capable of manipulating the Host header, potentially through missing header validation by the webserver or misconfigured host setup, can cause password reset emails to include links pointing to a domain under their control, which may lead to account takeover.

Recommendations Update to version 3.3.16 or later. Enable the force server vars setting to prevent the use of the HTTP Host header for generating URLs.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2026-29199

GHSA-7GM6-W7MX-58CR

Affected Products

Phpbb

References · 10

• https://osv.dev/vulnerability/GHSA-7gm6-w7mx-58cr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29199 · Security Note
• https://github.com/phpbb/phpbb-app · Note
• https://twitter.com/ADKCyber/status/2055496310761849316 · Twitter Post
• https://phpbb.com/community/viewtopic.php?t=2671024 · Note
• https://t.me/cveNotify/165178 · Telegram Post
• https://twitter.com/dailycve/status/2060367705941704869 · Twitter Post
• https://blog.phpbb.com/2026/04/27/phpbb-4-0-0-a2-release · Note
• https://hackerone.com/reports/3543246 · Note
• https://t.me/cveNotify/161994 · Telegram Post