The phpBB Team reports:
Changes since 3.3.16: Improper state verification in OAuth
implementation (SECURITY-293), improve secure downloads referer
checking (SECURITY-292), hardening of hostname lookups
(SECURITY-295).
Changes since 3.3.15: Password Reset Link Poisoning
(SECURITY-285), IDOR when composing PMs (SECURITY-286), CSRF on
report submission (SECURITY-287), Cross-User Notification Read
State Manipulation (SECURITY-290), hardening against
non-rasterized image uploads (SECURITY-289).
Changes since 3.3.14: Use jQuery to generate HTML from page
data (SECURITY-283).
The password reset issue fixed in 3.3.16 has been assigned
CVE-2026-29199 (CVSS 8.1). When force_server_vars is disabled,
phpBB takes the host name from the HTTP Host header to build the
password reset link, so an attacker able to control that header
can have reset mails point to a domain under their control, which
may lead to account takeover.