CVE-2026-29199

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-29199

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29199.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-29199

Aliases

GHSA-7gm6-w7mx-58cr

Published

2026-05-04T05:42:15.554Z

Modified

2026-07-08T08:12:45.459567405Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When forceservervars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover.

Database specific

{
    "cna_assigner": "hackerone",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "last_affected": "3.3.15"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "3.3.16"
                },
                {
                    "introduced": "e.g"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-640"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29199.json"
}

References

Affected packages

Git / github.com/phpbb/phpbb

Affected ranges

Type

GIT

Repo

https://github.com/phpbb/phpbb

Events

Introduced

Fixed

555f0aaa6b892efb2e6b6edd2362302a3ef8b339

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.3.16"
        }
    ],
    "cpe": "cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*"
}

Affected versions

release-3.*

release-3.3.16-RC1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29199.json"