CVE-2026-45118
Received Received - Intake

Open Redirect and XSS in MyBB Forum Software

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $_SERVER['HTTP_REFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don't want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-45118
EUVD
EUVD-2026-61021

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb 1.8.40

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-83 The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects MyBB versions before 1.8.40. It is a reflected Cross-Site Scripting (XSS) issue in the Contact module caused by improper input validation. The contact.php file fails to validate the 'from' HTTP parameter or Referer header, allowing open redirects and JavaScript injection. Specifically, it accepts javascript: URIs, which can be exploited via a malicious link on the redirect page.

Detection Guidance

To detect this vulnerability, check if your MyBB installation is running a version prior to 1.8.40. You can verify the version by inspecting the footer of your MyBB forum or checking the version in the admin panel. Additionally, monitor network traffic for suspicious redirect URLs containing 'javascript:' or unusual parameters in the 'from' HTTP parameter or Referer header.

Impact Analysis

An attacker could trick users into clicking a malicious link, leading to script execution in their browser. This may result in session hijacking, data theft, or defacement of the forum. Users might unknowingly execute harmful scripts when redirected.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements or HIPAA's safeguards for sensitive health information. It may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Immediately upgrade your MyBB installation to version 1.8.40 or later. If upgrading is not immediately possible, disable the Contact module temporarily or apply the patch provided in the official MyBB security advisory. Ensure input validation is enforced for the 'from' parameter and Referer header to prevent open redirects and XSS attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45118. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart