CVE-2026-45123 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
MyBB is a widely deployed free and open-source forum software that facilitates community interactions through threaded discussions and user management features. A critical security flaw was identified within the remote requests functionality of MyBB versions prior to 1.8.40, specifically affecting how the application handles IPv6 addresses during server-side operations. This vulnerability stems from an incomplete implementation of input validation and host restriction mechanisms when processing external URLs or IP addresses requested by the forum software for features such as fetching remote content or verifying user identities through third-party services.
The core technical flaw resides in the fetch_remote_file function located within inc/functions.php, which is responsible for initiating HTTP requests to external hosts based on configuration settings or user input. The application maintains a list of disallowed remote hosts intended to prevent unauthorized access to internal resources or malicious endpoints. However, this default blacklist fails to account for IPv6 address formats, creating a significant blind spot in the security controls. When an attacker provides a target that utilizes an IPv6 address format, the validation logic does not correctly parse or restrict it according to the established policies designed for IPv4 addresses.
The vulnerability is exacerbated by a fail-open verification mechanism within the get_ip_by_hostname function. This utility function attempts to resolve hostnames and validate IP formats but returns no result when processing certain IPv6 inputs due to implementation gaps in its parsing logic. Instead of treating this lack of resolution as an error that should block the request, the calling code interprets a null or empty return value as a successful validation pass. Consequently, crafted remote targets containing specific IPv6 addresses can bypass the host restriction checks entirely, allowing the server to initiate connections to arbitrary external destinations under the guise of legitimate application behavior.
This architectural weakness enables Server-Side Request Forgery attacks against systems running vulnerable versions of MyBB. An attacker with access to forum features that trigger remote requests can manipulate these functions to force the server to connect to internal network services, cloud metadata endpoints, or other sensitive infrastructure components that are not directly accessible from the public internet. By leveraging this bypass, an adversary may potentially extract confidential data, map internal network topologies, or interact with backend APIs that lack proper authentication when accessed from trusted local addresses. The impact is particularly severe in environments where MyBB is deployed behind firewalls that trust traffic originating from localhost or specific private IP ranges.
The operational impact of this vulnerability extends beyond simple information disclosure. If the server has access to internal databases, administrative interfaces, or other microservices protected by network-level security controls rather than application-layer authentication, an attacker can exploit this flaw to pivot into those restricted zones. This could lead to unauthorized data exfiltration, modification of forum content through API manipulation, or further exploitation of connected services that rely on the perceived trustworthiness of requests originating from the MyBB server itself.
To mitigate this risk, administrators must upgrade immediately to version 1.8.40 or later, where the developers have corrected the IPv6 handling logic and ensured that validation failures result in request denial rather than acceptance. Until an upgrade is feasible, implementing a Web Application Firewall with rules specifically designed to detect and block anomalous remote requests involving IPv6 addresses can provide temporary protection. Additionally, reviewing server configurations to ensure that internal services do not rely solely on source IP verification for authentication adds defense-in-depth against potential exploitation of this flaw.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-918 Server-Side Request Forgery as defined by the Common Weakness Enumeration standards. The attack vector corresponds to ATT&CK technique T1105 Ingress Tool Transfer or potentially T1071 Application Layer Protocol depending on how the forged requests are utilized, highlighting the importance of strict input sanitization and robust host allowlisting mechanisms in server-side applications that interact with external networks.