CVE-2026-45129 in MyBB
Summary
by MITRE • 08/18/2026
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
MyBB is a widely deployed free and open-source forum software that facilitates community discussions through threaded conversations, user profiles, and administrative controls. A critical security flaw was identified within the Admin CP Recovery Codes module prior to version 1.8.40, specifically affecting how two-factor authentication recovery codes are managed for administrators. This vulnerability stems from a failure in server-side request validation mechanisms, which allows same-site attackers to perform unauthorized state changes on behalf of authenticated administrator users without their knowledge or consent.
The technical root cause lies in the implementation details found within admin/modules/home/preferences.php. Specifically, the page handling recovery code regeneration via the action=recovery_codes parameter processes GET requests that trigger a database update to mybb_adminoptions.recovery_codes. In secure web application design, operations that modify sensitive security settings or credentials should exclusively utilize POST requests with anti-CSRF tokens. By relying on GET requests for this critical function, MyBB inadvertently exposed an endpoint susceptible to Cross-Site Request Forgery attacks. An attacker can craft a malicious URL containing the specific parameters required to regenerate recovery codes and trick an administrator into visiting it while logged in.
The operational impact of this vulnerability is severe because it directly compromises the integrity of two-factor authentication for administrative accounts. Recovery codes are typically used as backup access methods when primary MFA devices are lost or unavailable. By forcing a regeneration of these codes, an attacker effectively invalidates any previously issued recovery codes and generates new ones that only the attacker can control if they have intercepted the response or manipulated the session context appropriately. This action disrupts legitimate administrative operations by locking out administrators who rely on their old recovery codes while simultaneously granting potential unauthorized access to those controlling the newly generated codes.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF), as it involves tricking a user into executing unwanted actions within an authenticated web application. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK frameworks, this behavior relates to techniques involving account manipulation and credential access through social engineering or automated exploitation of session management flaws. The lack of synchronization between the request method (GET) and its side effects constitutes a fundamental violation of secure coding practices regarding state-changing operations.
Mitigation for existing installations requires immediate upgrading to MyBB version 1.8.40 or later, where this issue has been resolved by implementing proper CSRF protection mechanisms such as anti-forgery tokens and restricting sensitive actions to POST requests only. For administrators unable to upgrade immediately due to compatibility constraints with custom plugins or themes, temporary mitigations include disabling the recovery code regeneration feature if not strictly necessary, ensuring that administrative sessions have short timeouts to limit the window of opportunity for exploitation, and monitoring admin logs for unusual patterns in preference changes. Organizations should also enforce strict Content Security Policies and ensure that browsers are configured to block third-party cookies where applicable, although these measures provide only partial protection against same-site CSRF attacks. Regular security audits focusing on session management and state-changing API endpoints are recommended to prevent similar vulnerabilities from being introduced during future development cycles or plugin integrations.