CVEvulnerability

CVE-2026-45129

4.6 MEDIUM Published 2026-08-18 Modified 2026-09-08 Official page ↗

Status: Deferred
Published: 2026-08-18
Last modified: 2026-09-08
Assigner: [email protected]
CVSS 3.1 ([email protected]): 4.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Weaknesses: CWE-352

Description

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.

Weakness · CWE (1)

CWE-352 Cross-Site Request Forgery weakness

References

https://github.com/mybb/mybb/commit/d2d9e47b53d85101cf25cb47e882bc7ba76355a4 github.com
https://github.com/mybb/mybb/releases/tag/mybb_1840 github.com
https://github.com/mybb/mybb/security/advisories/GHSA-75vg-6wgp-mcc9 github.com
https://mybb.com/versions/1.8.40 mybb.com

CVE-2026-45129

Description

Related

Weakness · CWE (1)

References