Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS scores by FIRST (EPSS SIG), generated by Empirical Security. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-29199 is a high-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Phpbb. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-12 (Identity Proofing) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-29199 is a Host Header Injection vulnerability in phpBB versions before 3.3.16 that enables password reset link poisoning. When the force_server_vars configuration option is disabled, the application's code extracts the server's hostname from the HTTP Host header to construct password reset link URLs sent via email. This allows manipulation of the generated links if the header is not properly validated or sanitized by the web server.
Attackers can exploit this vulnerability over the network with low complexity and no required privileges, provided they can control the Host header in requests, such as through misconfigured virtual host setups or absent web server header validation. By doing so, they can poison password reset emails to point to a domain under their control. If a targeted user interacts with the malicious link (e.g., by clicking it to reset their password), the attacker can achieve high confidentiality and integrity impacts, potentially resulting in account takeover. The issue is scored at CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and maps to CWE-640.
phpBB versions 3.3.16 and later address this vulnerability. Additional details are available in the originating HackerOne report at https://hackerone.com/reports/3543246.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26892
Vulnerability Data
phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset…
more
link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Identity proofing at appropriate assurance levels ensures forgotten-password recovery cannot succeed without strong verification of the user.
Authenticator management requires secure distribution, reset, and verification procedures that directly address weak password recovery flows.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes password reset/recovery flows.
Identity proofing is the core control that prevents weak or bypassed recovery mechanisms.
Authentication policy covers strength/MFA but does not address recovery path weaknesses.
Secure SDLC reduces implementation flaws but is not specific to password-recovery design.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-coding standards can prevent weak recovery implementations, yet the control is wider in scope.