phpBB before version 3.3.16 contains a host header injection flaw that allows attackers to modify the Host header sent to the web application. When the PHP directive force_server_vars is disabled, the application uses the Host header to construct the URL for password reset emails. An attacker who can inject a malicious Host header can cause the reset link to point to a site under their control, enabling phishing of the reset token and subsequent account takeover. This flaw maps to CWE‑640, representing improper source validation for an externally supplied identifier.

All installations of phpBB version 3.3.x earlier than 3.3.16 are affected. The issue is specific to the phpBB forum software, and no other vendor or product variants are known to be impacted.

The exploit requires the ability to supply a forged Host header to the vulnerable phpBB instance, typically achievable by hosting a site that forwards requests or by manipulating DNS or server configuration to enable arbitrary Host values. Because password reset requests are often triggered by legitimate users or automated processes, an attacker can lure a user into clicking the poisoned link. The EPSS score indicates a very low but nonzero probability of exploitation (< 1%), and the vulnerability is not listed in CISA’s KEV catalog, but the potential for account compromise is high. The CVSS score is 8.1, indicating high severity, which underlines the need for a prompt patch.