CVE-2026-45129
Received Received - Intake

Admin Recovery Code Rotation in MyBB

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-45129
EUVD
EUVD-2026-61019

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb to 1.8.40 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45129 is a Cross-Site Request Forgery (CSRF) vulnerability in MyBB forum software versions prior to 1.8.40. It affects the Admin Control Panel (ACP) Recovery Codes module, which regenerates recovery codes on GET requests without proper CSRF protection. Attackers can exploit this by tricking an admin into visiting a specially crafted URL to rotate their recovery codes.

Detection Guidance

Check MyBB version in use. If running a version prior to 1.8.40, the system is vulnerable. Inspect admin/modules/home/preferences.php for missing CSRF protection in recovery code regeneration.

Impact Analysis

An attacker could force an admin to regenerate their recovery codes, potentially locking them out of their account if the attacker changes the codes. This could disrupt forum administration and compromise account access. The impact is limited as it requires same-site interaction and admin privileges.

Compliance Impact

This vulnerability may pose compliance risks by potentially exposing admin account access, which could lead to unauthorized changes in forum settings or user data. However, no direct impact on GDPR or HIPAA compliance is specified in the provided context.

Mitigation Strategies
  • Upgrade MyBB to version 1.8.40 or later immediately.
  • Review and apply the patch in admin/modules/home/preferences.php to enforce POST requests and CSRF checks.
  • Monitor admin accounts for unexpected recovery code regeneration events.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart