CVE-2026-29199: phpBB Password Reset Link Poisoning via Host Header Injection
Summary
CVE-2026-29199: phpBB has Password Reset Link Poisoning via Host Header injection. Affects phpbb/phpbb across 2 version ranges.
>= 3.0.0, < 3.3.16
>= 4.0.0-a1, < 4.0.0-a2
Fixed in 3.3.16 or 4.0.0-a2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpBB is a widely used open-source forum software that enables users to create and manage online discussion boards. It offers features such as user authentication, customizable themes, and extensive plugin support. However, prior to version 3.3.16, phpBB is vulnerable to a Host Header Injection issue that can compromise the security of password reset functionalities.
Vulnerability Detail
The vulnerability arises from phpBB's handling of the HTTP Host header when the 'force_server_vars' setting is disabled. In this scenario, the server's hostname is derived from the Host header, which is then used to generate password reset link URLs. An attacker can exploit this by manipulating the Host header, potentially leading to password reset emails containing links to an attacker-controlled domain. This could result in unauthorized access to user accounts and account takeover.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.3.163.3.16composer require phpbb/phpbb:3.3.16 -
>= 4.0.0-a1, < 4.0.0-a24.0.0-a2composer require phpbb/phpbb:4.0.0-a2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can enable the 'force_server_vars' setting in their phpBB configuration. This will prevent the application from relying on the Host header for hostname extraction, thereby mitigating the risk of this vulnerability.
Conclusion
The vulnerability identified as CVE-2026-29199 poses a significant risk to phpBB installations prior to the patched versions. It is crucial for users to update their software to the latest versions to protect against potential account takeover attacks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for phpbb/phpbb →
FAQ
Host Header Injection is a type of attack where an attacker manipulates the Host header in an HTTP request to influence the behavior of a web application, potentially leading to security vulnerabilities.
If exploited, this vulnerability can allow attackers to send password reset emails with links to malicious domains, leading to account takeover and unauthorized access to user accounts.
Versions of phpBB prior to 3.3.16 and 4.0.0-a2 are affected. You can check your version in the admin panel or by reviewing the composer.lock file.
If an immediate update is not possible, consider enabling the 'force_server_vars' setting as a temporary workaround to mitigate the risk of exploitation.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for phpbb/phpbb.
