CVE-2026-45118: MyBB: Contact page reflected XSS
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $SERVER['HTTPREFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the Click here if you don't want to wait any longer link because $forceredirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBBto a version that resolves this vulnerability.Fixed in 1.8.40 - Compensating control
If you cannot upgrade immediately, restrict/limit the ability for users to supply arbitrary redirect targets by blocking or filtering requests with a malicious/unsafe HTTP Referer or a crafted HTTP parameter named "from" to contact.php, and enforce redirect target allowlisting at the edge (e.g., WAF/Reverse proxy) for the MyBB Contact module.
Event History
Frequently Asked Questions
Which deployments are exposed and what user interaction is required?
MyBB installations running versions earlier than 1.8.40 are affected when the Contact module is available. The issue is exploitable remotely without attacker authentication, but the victim must select the redirect page's "Click here if you don't want to wait any longer" link.
What input does an attacker control to trigger the injection?
An attacker can supply a javascript: URI through the from HTTP parameter or the Referer HTTP header. Because the Contact module passes this value to redirect() without sufficient validation, the URI is placed in the manual redirect link and can execute JavaScript when selected.
What version fixes the issue?
Upgrade MyBB to version 1.8.40, which fixes the redirect URL and protocol validation flaw in the Contact module.