CVE-2026-46482
Received Received - Intake

CAPTCHA Bypass in MyBB Registration

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
### Impact The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) ### Details The public _Registration_ workflow ([`member.php?action=do_register`](https://github.com/mybb/mybb/blob/mybb_1839/member.php#L262-L307)) accepts a hidden field `question_id` — expected to match the question session identifier (`mybb_questionsessions.sid`) — and validates the challenge answer without a fail-closed fallback for invalid identifiers. If the value is blank, forged, or expired, the request continues without a question-related error. ### Patches MyBB 1.8.(...) resolves this issue with the following changes: - Commit: https://github.com/mybb/mybb/commit/ - `.patch`: https://github.com/mybb/mybb/commit/.patch ### References - Release Notes: https://mybb.com/versions/1.8.(...)/ ### For more information Go to [mybb.com/security](https://mybb.com/security/) to report possible security concerns or to learn more about security research at MyBB. ### Contact The security team can be reached at [security@mybb.com](mailto:security@mybb.com).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-46482
EUVD
EUVD-2026-61052

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mybb mybb 1.8.*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the registration component of a software not properly validating a text-based CAPTCHA security question. Attackers can bypass this challenge by submitting a specially crafted value, allowing unauthorized registration attempts.

Detection Guidance

This vulnerability can be detected by checking MyBB registration logs for unusual activity where the security question CAPTCHA is bypassed. Inspect member.php for improper handling of the question_id field and validate if the system fails to enforce security questions when question_id is blank, forged, or expired.

Impact Analysis

This flaw could allow attackers to create unauthorized accounts on the affected system, potentially leading to spam, fraudulent activities, or other malicious actions using fake registrations.

Compliance Impact

This vulnerability allows attackers to bypass security question CAPTCHA during registration without proper validation. While not directly violating GDPR or HIPAA, it could undermine security controls designed to prevent automated account creation, potentially enabling spam or fraudulent registrations that may expose personal data or violate access control requirements under these regulations.

Mitigation Strategies

Update MyBB to version 1.8.(...) or later to apply the patch that fixes the CAPTCHA validation issue in the registration component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46482. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart