CVE-2026-45129
MediumCVSS 4.6Summary
MyBB before version 1.8.40 in the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The action=recovery_codes page regenerates Two-Factor Authentication recovery codes on GET requests without request forgery protection.
Risk Assessment
An attacker can invalidate an administrator's existing recovery codes, potentially leading to administrator lockout or account takeover.
Recommendation
Update MyBB to version 1.8.40 or later, which includes a fix for request validation in the Recovery Codes module.
Original NVD description (English source)
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.