phpBB CVE-2026-29199

Exploitation requires three specific conditions to be met simultaneously: phpBB configuration must have force_server_vars disabled (not the default secure configuration), the webserver or reverse proxy must accept and forward arbitrary Host header values without validation (common in misconfigured shared hosting or improperly configured nginx/Apache reverse proxies), and the victim must click the poisoned password reset link within the token validity window (typically 1 hour). Attack is limited by user interaction requirement (UI:R in CVSS) as victims must actively request password reset and click the malicious link. Properly configured deployments with Host header validation at the web tier, or those using force_server_vars enabled, are not exploitable. The vulnerability cannot be exploited against users who do not initiate password reset requests.

Real-world risk assessment reveals conflicting signals requiring careful interpretation. CVSS 8.1 (High) reflects network attack vector with low complexity and no authentication (AV:N/AC:L/PR:N), but requires user interaction (UI:R) as the victim must click the poisoned reset link. However, EPSS score of 0.02% (4th percentile) indicates extremely low observed exploitation probability in the wild, suggesting this attack requires specific preconditions not commonly met. The vulnerability is NOT listed in CISA KEV, confirming no confirmed active exploitation. Attack success depends on multiple prerequisites: force_server_vars being disabled, webserver accepting arbitrary Host headers, and victim clicking the malicious link within the reset token validity window. For properly configured deployments with header validation at the web tier or force_server_vars enabled, risk is minimal. Primary risk exists in shared hosting environments or misconfigured reverse proxy setups where Host header validation is absent. This is a configuration-dependent vulnerability where CVSS severity overstates real-world risk for most deployments.

An attacker identifies a phpBB forum running version 3.3.15 with force_server_vars disabled behind a misconfigured reverse proxy that doesn't validate Host headers. The attacker initiates a password reset for a target user account while intercepting the request and modifying the Host header to 'attacker-controlled-domain.com'. The phpBB application generates a password reset email containing a link like 'https://attacker-controlled-domain.com/ucp.php?mode=reset&token=valid_reset_token'. When the victim clicks the link, their valid reset token is sent to the attacker's server, who can then use it on the legitimate domain to reset the victim's password and gain full account access. No public exploit code identified at time of analysis, though the attack technique is straightforward for attackers familiar with Host header manipulation.