EUVD-2026-26892
GHSA-7gm6-w7mx-58cr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover.
AnalysisAI
Host header injection in phpBB versions 3.0.0 through 3.3.15 enables password reset link poisoning when force_server_vars is disabled. Attackers manipulating HTTP Host headers can redirect password reset links to attacker-controlled domains, enabling credential theft and account takeover. CVSS 8.1 with network vector and no authentication required, though EPSS exploitation probability is low (0.02%, 4th percentile), suggesting limited observed exploitation activity. Vendor-released fix available in phpBB 3.3.16.
Technical ContextAI
This vulnerability exploits improper validation of the HTTP Host header in phpBB's password reset functionality. When the force_server_vars configuration option is disabled (non-default in some deployments), phpBB extracts the server hostname directly from the user-supplied Host header to construct password reset URLs. This represents CWE-640 (Weak Password Recovery Mechanism for Forgotten Password), where the application trusts unvalidated client input for security-critical URL generation. The attack relies on webserver misconfiguration or missing header validation at the reverse proxy/load balancer layer. Affected versions span phpBB 3.0.0 through 3.3.15 per CPE data, covering over a decade of releases. The vulnerability requires the webserver to accept arbitrary Host header values and forward them to phpBB without sanitization.
RemediationAI
Upgrade to phpBB 3.3.16 or later immediately, which addresses the Host header injection vulnerability. For installations unable to upgrade immediately, enable the force_server_vars configuration option in phpBB's config.php to force hostname extraction from server variables rather than HTTP headers, though this may require additional webserver configuration to set correct SERVER_NAME values. Implement Host header validation at the webserver or reverse proxy layer by configuring an explicit whitelist of allowed Host values and rejecting requests with unrecognized headers-note this may break legitimate access through alternative domains or IP addresses if not carefully configured. For nginx, use 'if ($host !~* ^(forum\.example\.com)$) { return 444; }' directives; for Apache, use mod_rewrite rules to validate Host header. Monitor password reset request logs for suspicious patterns such as external domains in generated URLs. Reference the HackerOne report at https://hackerone.com/reports/3543246 for additional technical details. Each mitigation has trade-offs: force_server_vars requires proper server configuration, header validation may block legitimate multi-domain access, and upgrade requires testing for compatibility with custom modifications.
Account hijacking in phpBB is possible due to improper authentication checks in the OAuth implementation, affecting defa
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Inject
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote A
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in
Account takeover in phpBB via OAuth state-verification flaw enables remote attackers to link a victim's forum account to
The fulltext search component in phpBB before 3.2.6 allows Denial of Service. Rated high severity (CVSS 7.5), this vulne
Privilege escalation in phpBB allows an authenticated administrator with limited rights to grant themselves permissions
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the fo
phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. Rated medium severity (CVSS 6.5), this vuln
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of G
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10.php of the component Smiley P
SQL injection in phpBB forum software allows authenticated users to execute arbitrary SQL queries through a flawed profi
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today