CVE-2026-45118
CriticalCVSS 9.3Summary
MyBB before version 1.8.40 contains a vulnerability in the Contact module that does not properly validate redirect URLs, leading to open redirect and reflected JavaScript code injection.
Risk Assessment
The vulnerability allows an attacker to redirect users to malicious sites or execute scripts in the victim's browser, potentially leading to data theft.
Recommendation
It is recommended to update MyBB to version 1.8.40 or later and review the Contact module configuration.
Original NVD description (English source)
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $_SERVER['HTTP_REFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don't want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40.