CVE-2026-45734: MyBB: Default CAPTCHA missing invalidation
MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=doresendactivation, member.php?action=dolostpw, member.php?action=doemailuser, and sendthread.php?action=dosendtofriend do not call captcha::invalidatecaptcha() for the MyBB Default CAPTCHA selected by the captchaimage setting. A valid response can therefore be reused until a non-vulnerable endpoint invalidates it, an incorrect response is submitted, or the challenge expires. This issue is fixed in version 1.8.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MyBB (built-in CAPTCHA)to a version that resolves this vulnerability.Fixed in 1.8.40
Event History
Frequently Asked Questions
Which deployments and features are affected?
Forums running MyBB versions earlier than 1.8.40 are affected when the built-in MyBB Default CAPTCHA is selected through the captchaimage setting. The affected validation paths are the contact form, activation resend, password recovery, email-user, and send-to-friend functions.
What does an attacker need to exploit the issue?
An attacker needs one valid answer for a CAPTCHA challenge and can replay it against the affected successful-validation paths. The challenge remains reusable until it expires, an incorrect response is submitted, or a non-vulnerable endpoint invalidates it.
What is the remediation?
Upgrade MyBB to version 1.8.40, which fixes the missing CAPTCHA invalidation. Until then, avoid relying on the built-in Default CAPTCHA as a single-use control for the affected workflows.