phpBB Host Header Injection Vulnerability Leading to Password Reset Link Poisoning

A host header injection vulnerability has been identified in phpBB versions prior to 3.3.16. This vulnerability can lead to password reset link poisoning. When the 'force_server_vars' option is disabled, the server's hostname may be derived from the HTTP Host header. This header is used to create the password reset link URL. An attacker who can manipulate the Host header, possibly through a misconfigured host setup or inadequate header validation by the web server, could make password reset emails include a link to an attacker-controlled domain, potentially allowing for account takeover.

Impact

Exploitation of this vulnerability could result in unauthorized account access through manipulated password reset links.