CVE-2026-45129: MyBB: ACP Recovery Codes CSRF
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recoverycodes page regenerates Two-Factor Authentication recovery codes in mybbadminoptions.recoverycodes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBB Admin CP Recovery Codesto a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Which deployments are affected?
MyBB installations prior to version 1.8.40 are affected when an administrator uses the Admin CP Recovery Codes functionality. The vulnerable action is the Recovery Codes page at action=recovery_codes.
What does an attacker need to exploit this issue?
An attacker needs to be a same-site attacker and cause a victim administrator to visit a specially crafted URL. The attacker does not need the administrator to submit a form because the recovery-code regeneration occurs through a GET request.
What should administrators do if they cannot patch immediately?
Upgrade MyBB to version 1.8.40, which fixes the request-validation issue. Until upgrading, administrators should avoid following untrusted URLs while authenticated to the Admin CP.
How can an administrator tell whether recovery codes may have been rotated?
Administrators can check whether recovery codes changed unexpectedly in the mybb_adminoptions.recovery_codes data associated with their account. Unexpected regeneration of these codes indicates the affected action may have been triggered.