Host Header Injection Vulnerability in phpBB by phpBB Group

CVE-2026-29199

What is CVE-2026-29199?

The phpBB platform, specifically versions prior to 3.3.16, is susceptible to a Host Header Injection vulnerability that can allow attackers to manipulate password reset links. When the server variable 'force_server_vars' is disabled, the vulnerability enables an attacker to extract the server's hostname from the HTTP Host header, leading to the creation of malicious password reset URLs. This potentially allows attackers to conduct phishing attacks by directing victims to an attacker-controlled domain, thereby compromising user accounts.

References