phpBB Host Header Injection Enables Password Reset Poisoning

CVE-2026-29199 exploits a critical flaw in phpBB's password reset mechanism when the force_server_vars setting is disabled. The vulnerability allows attackers to manipulate the HTTP Host header, causing the application to generate password reset links pointing to attacker-controlled domains instead of the legitimate server. This is particularly dangerous because password reset emails are inherently trusted communications—users click links expecting them to lead to legitimate password recovery pages. Any phpBB installation before version 3.3.16 with force_server_vars disabled is at risk, making this a widespread threat affecting forum administrators and their user bases who may unknowingly visit phishing domains and compromise their credentials.

While this CVE doesn't currently map to specific MITRE ATT&CK techniques in the framework, it represents a class of attacks that Casky's 754 security skills would detect through behavioral analysis of web server request patterns and email content generation flows. Practitioners using Casky would identify the attack pattern through detection of: (1) anomalous Host header values deviating from baseline server configuration, (2) discrepancies between the expected hostname and dynamically generated URLs in application logs, and (3) unusual email content containing externally-controlled domain references. Claude's extended reasoning would correlate these indicators to flag potential credential access attacks (T1110 family) and initial access vectors (T1566 - Phishing), allowing defenders to catch Host header injection attempts before malicious password reset links reach end users. The intelligence would highlight the critical importance of validating and hardening host header handling in web applications.