CVE-2025-70810: XSS in phpBB 3.3.15 via Login

The vulnerability stems from a lack of proper CSRF protection in the phpBB login process. An attacker could craft a malicious request, disguised as a legitimate login attempt, and trick a logged-in user into unknowingly executing it. Successful exploitation could lead to an attacker gaining control of the user's account, performing actions on their behalf, and potentially accessing sensitive data. The scope of the impact depends on the user's privileges within phpBB. An administrator account compromise could lead to complete control of the forum.

1. Veröffentlicht2026-04-09
2. Geändert2026-04-14
3. EPSS aktualisiert2026-04-17

Since a fixed version is not yet available, mitigation focuses on reducing the attack surface and implementing CSRF protection measures. Implement robust CSRF tokens for all sensitive operations, including the login process. Educate users about the risks of clicking on suspicious links or visiting untrusted websites. Consider enabling HTTP Strict Transport Security (HSTS) to prevent man-in-the-middle attacks. Regularly review and update phpBB's security configuration. After a patched version is released, upgrade phpBB immediately and verify the fix by confirming that CSRF tokens are properly implemented and validated for all login-related actions.