{"action":"Upgrade phpbb/phpbb to 3.3.16 or later.","affected":[{"fixed":"3.3.16","introduced":"3.0.0"},{"fixed":"4.0.0-a2","introduced":"4.0.0-a1"}],"component":"phpbb/phpbb","cve_ids":["CVE-2026-29199"],"ecosystem":"Packagist","epss":0.00249,"exploited":false,"fixed_versions":["3.3.16","4.0.0-a2"],"ghsa_id":"GHSA-7gm6-w7mx-58cr","id":"tcs_01M5KEY2W129NR0BRXBS07QSS3","modified_at":"2026-09-10T03:50:46.121406585Z","published_at":"2026-05-04T09:31:09Z","references":["https://osv.dev/vulnerability/GHSA-7gm6-w7mx-58cr","https://nvd.nist.gov/vuln/detail/CVE-2026-29199","https://hackerone.com/reports/3543246","https://blog.phpbb.com/2026/04/27/phpbb-4-0-0-a2-release","https://github.com/phpbb/phpbb-app","https://www.phpbb.com/community/viewtopic.php?t=2671024"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-7gm6-w7mx-58cr","url":"https://osv.dev/vulnerability/GHSA-7gm6-w7mx-58cr"}],"summary":"phpBB has Password Reset Link Poisoning via Host Header injection"}