CVE-2026-29199: 
PHP vulnerability analysis and mitigation

CVE-2026-29199 is a Host Header Injection vulnerability in phpBB that enables password reset link poisoning, potentially leading to account takeover. When the force_server_vars configuration option is disabled, phpBB extracts the server hostname from the HTTP Host header to construct password reset URLs. An attacker who can manipulate this header — via a misconfigured host setup or absent web server validation — can cause reset emails to point to an attacker-controlled domain. All phpBB versions before 3.3.16 are affected. The vulnerability was published on May 4, 2026, with a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). When force_server_vars is disabled in phpBB's configuration, the application trusts the HTTP Host header supplied by the client to determine the server's hostname, which is then embedded into the password reset link sent via email. An attacker intercepts or crafts a password reset request with a spoofed Host header (e.g., Host: attacker.com), causing the generated reset URL to reference the attacker's domain rather than the legitimate phpBB server. This attack is network-accessible, requires no authentication, but does require user interaction (the victim must click the poisoned link). The vulnerability was originally reported via HackerOne (GitHub Advisory, HackerOne Report).

Successful exploitation allows an attacker to redirect password reset emails to a domain they control, enabling credential harvesting when the victim clicks the link and submits a new password on the attacker's phishing page. This results in full account takeover, with high confidentiality and integrity impact (access to the victim's account data and the ability to modify it). Availability is not directly impacted. The attack scope is limited to individual user accounts, but could be chained against administrator accounts for broader forum compromise (GitHub Advisory).

As of the time of publication, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.017% (0.000170), indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify phpBB forum instances running versions prior to 3.3.16 using search engines (e.g., Google dork: inurl:/ucp.php?mode=sendpassword) or web scanning tools. Confirm that force_server_vars is not explicitly enabled by observing default or misconfigured deployments.
2. Initiate password reset: Navigate to the phpBB password reset page (/ucp.php?mode=sendpassword) and submit a reset request for a target user account (e.g., an administrator).
3. Inject malicious Host header: Intercept the HTTP request using a proxy tool (e.g., Burp Suite) and modify the Host header to an attacker-controlled domain (e.g., Host: attacker.com).
4. Victim receives poisoned email: phpBB generates the password reset URL using the injected hostname, so the reset email sent to the victim contains a link such as https://attacker.com/ucp.php?mode=confirm&....
5. Credential harvesting: The attacker hosts a phishing page at attacker.com that mimics the phpBB password reset form. When the victim clicks the link and submits a new password, the attacker captures the credentials.
6. Account takeover: The attacker uses the harvested credentials to log into the legitimate phpBB forum as the victim (GitHub Advisory, HackerOne Report).

• Network: HTTP requests to /ucp.php?mode=sendpassword containing a Host header that does not match the legitimate server's configured hostname or domain.
• Logs: Web server access logs showing password reset requests with anomalous or external Host header values (e.g., Host: attacker.com instead of the forum's actual domain); multiple reset requests for high-privilege accounts in a short timeframe.
• Application: Password reset emails delivered to users with reset links pointing to unexpected or external domains rather than the configured phpBB server URL.

Upgrade phpBB to version 3.3.16 or later, which addresses this vulnerability (GitHub Advisory). As an immediate workaround, enable force_server_vars in the phpBB administration panel (ACP > General > Server Configuration > Server Settings) to prevent hostname extraction from the HTTP Host header. Additionally, configure the web server (Apache, Nginx, etc.) to validate and restrict accepted Host header values, rejecting requests with unrecognized hostnames. Prioritize patching for publicly accessible phpBB instances.