CVE-2026-46482 in MyBB
Summary
by MITRE • 08/18/2026
### Impact The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value.
[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
### Details The public _Registration_ workflow ([`member.php?action=do_register`](https://github.com/mybb/mybb/blob/mybb_1839/member.php#L262-L307)) accepts a hidden field `question_id` — expected to match the question session identifier (`mybb_questionsessions.sid`) — and validates the challenge answer without a fail-closed fallback for invalid identifiers. If the value is blank, forged, or expired, the request continues without a question-related error.
### Patches MyBB 1.8.(...) resolves this issue with the following changes:
- Commit: https://github.com/mybb/mybb/commit/ - `.patch`: https://github.com/mybb/mybb/commit/.patch
### References - Release Notes: https://mybb.com/versions/1.8.(...)/
### For more information Go to [mybb.com/security](https://mybb.com/security/) to report possible security concerns or to learn more about security research at MyBB.
### Contact The security team can be reached at [[email protected]](mailto:[email protected]).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability described involves a critical flaw in the registration workflow of the MyBB forum software, specifically within the component responsible for handling text-based Security Question CAPTCHA challenges. This issue allows attackers to bypass authentication controls during account creation by exploiting improper validation logic associated with session identifiers and challenge answers. The core technical deficiency lies in how the system processes the hidden field named question_id alongside the user-provided answer to a security question. Under normal operational parameters, this workflow expects the provided question_id to match an active session identifier stored server-side as mybb_questionsessions.sid while simultaneously verifying that the submitted answer corresponds correctly to the selected question. However, the implementation fails to enforce strict validation when discrepancies arise between these values or when inputs are malformed.
In a secure design, any mismatch in identifiers or invalid challenge responses should trigger immediate rejection of the request through a fail-closed mechanism. Instead, this vulnerability permits execution continuity even if the provided identifier is blank, forged, expired, or otherwise inconsistent with expected session data. Consequently, an attacker can manipulate HTTP requests to submit arbitrary values for both the question_id and the answer field without triggering appropriate error states that would halt registration attempts. This lack of rigorous input validation effectively neutralizes the protective intent of the security question mechanism, rendering it functionally inert against automated or manual bypass techniques.
From a risk assessment perspective, this flaw is classified with moderate severity due to its network-accessible nature and low complexity requirements for exploitation. Attackers do not require prior authentication privileges nor user interaction beyond initiating a registration request, making remote exploitation straightforward using standard web tools or custom scripts. The primary impact centers on integrity degradation rather than confidentiality loss or availability disruption since the vulnerability does not directly expose sensitive data or crash services but enables unauthorized account creation. Such accounts can subsequently be leveraged for further malicious activities including spam distribution, phishing campaigns, reputation manipulation within community forums, and potential escalation to higher privilege levels if additional vulnerabilities exist in post-registration workflows.
This type of weakness aligns closely with CWE-287 which describes Improper Authentication where an actor is able to bypass authentication mechanisms due to flawed logic or missing checks. Additionally it maps to ATT&CK technique T1078 Valid Accounts as attackers may create legitimate-looking credentials that blend into normal traffic patterns thereby evading basic anomaly detection systems designed around known bad actors rather than structural weaknesses in registration processes. The absence of rate limiting combined with this bypass capability amplifies the potential for abuse by allowing rapid bulk account generation which strains server resources and complicates moderation efforts significantly over time.
Mitigation strategies must prioritize enforcing strict validation rules at multiple layers within the application stack. Developers should ensure that all session-related tokens are validated against active database records before processing any associated form submissions including answers to security questions. Implementing fail-closed behavior ensures that any deviation from expected input formats results in immediate request termination accompanied by appropriate logging for forensic analysis. Furthermore integrating robust CAPTCHA solutions such as reCAPTCHA or hCaptcha provides stronger assurance of human interaction reducing reliance solely on static security questions which are increasingly susceptible to automated solving techniques via machine learning models and optical character recognition services.
Administrators operating affected versions should apply the official patch released by MyBB immediately upon availability while monitoring server logs for signs of exploitation attempts characterized by unusual spikes in registration activity or requests containing malformed session identifiers. Enabling CAPTCHA challenges at login stages as well adds defense-in-depth measures that mitigate risks posed by compromised credentials derived from these unauthorized registrations. Regular security audits focusing on authentication flows and input validation practices will help identify similar weaknesses across other components ensuring comprehensive protection against evolving threat landscapes targeting web application registration mechanisms.