CVE-2026-45734

Received Received - Intake

CAPTCHA Bypass via Replay in MyBB

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the MyBB Default CAPTCHA selected by the captchaimage setting. A valid response can therefore be reused until a non-vulnerable endpoint invalidates it, an incorrect response is submitted, or the challenge expires. This issue is fixed in version 1.8.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-07

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-45734

EUVD

EUVD-2026-61014

Affected Vendors & Products

Vendor	Product	Version / Range
mybb	mybb	1.8.40

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-837	The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.

Attack-Flow Graph

Executive Summary

This vulnerability affects MyBB forum software versions before 1.8.40. The default CAPTCHA system fails to invalidate used CAPTCHA challenges after successful validation. This allows attackers to bypass CAPTCHA controls by replaying the same valid CAPTCHA response across multiple endpoints like Contact Us or password reset functions.

Detection Guidance

Check MyBB version with: grep -r "$settings['bbversion']" ./inc/settings.php. If version is below 1.8.40, the system is vulnerable. Review logs for repeated CAPTCHA submissions across endpoints like contact.php, member.php, or sendthread.php.

Impact Analysis

Attackers could automate actions like sending spam messages, resetting passwords, or creating multiple accounts without solving new CAPTCHAs. This could lead to abuse of forum features, compromised accounts, or spam dissemination.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a CAPTCHA bypass in MyBB forum software. However, if exploited, it could enable unauthorized access to user data or functions, potentially violating data protection requirements under GDPR or HIPAA depending on the context of use.

Mitigation Strategies

Upgrade MyBB to version 1.8.40 or later immediately. If upgrading is not possible, apply the patch from the commit c2ed54f9259b9ce05728a9e657169033fe4adffc to enforce CAPTCHA invalidation in contact.php, member.php, and sendthread.php.

Hi! I’m here to help you understand CVE-2026-45734. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70