CVE-2026-29199

8.1 Élevée

Publiée le 04/05/2026 à 09:15 · Modifiée le 17/06/2026 à 12:29 · Analysée par le NVD · Source : support@hackerone.com

Description

phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover.

Traduire en français

Produits concernés

phpBB
Phpbb phpbb

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-640

Références

https://hackerone.com/reports/3543246 Permissions Required

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories