CVE-2026-45123: MyBB: IPv6 SSRF
MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetchremotefile() fails open when getipbyhostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBBto a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Which deployments are exposed?
Instances running MyBB before 1.8.40 are affected when the remote requests feature can be induced to fetch an attacker-crafted target. The default disallowed remote-host list does not cover IPv6 addresses.
What does an attacker need to exploit this issue?
An attacker needs privileges to use a feature or workflow that triggers MyBB remote requests; no user interaction is required. They can use a crafted IPv6 target to bypass host restrictions because hostname resolution does not return IPv6 results and the verification fails open.
What should administrators do if they cannot patch immediately?
Upgrade MyBB to version 1.8.40. If upgrading cannot happen immediately, restrict or disable access to functionality that can trigger remote requests, particularly for lower-privileged users, and prevent the application host from reaching sensitive internal and IPv6 network destinations.
How can I determine whether my instance is affected?
Review the installed MyBB version and treat versions earlier than 1.8.40 as affected. Also inspect uses of fetch_remote_file() and any remote-request functionality for requests to IPv6 literals or IPv6-resolving hostnames that bypass intended host restrictions.