CVE-2026-45118: MyBB Contact Module XSS Vulnerability

CVE-2026-45118 Overview

CVE-2026-45118 is an open redirect and reflected JavaScript code injection vulnerability in MyBB, a free and open source forum software. The flaw resides in the Contact module (contact.php), which fails to validate redirect URLs or protocols before passing them to the redirect() function. Attackers can supply a javascript: URI through the from HTTP parameter or the Referer header, causing arbitrary script execution when a victim clicks the redirect link. The issue affects all MyBB versions prior to 1.8.40 and is classified under [CWE-83: Improper Neutralization of Script in Attributes in a Web Page].

Critical Impact
An unauthenticated attacker can craft a malicious link that executes JavaScript in a victim's browser session, enabling session hijacking, credential theft, and forum account takeover.

Affected Products

MyBB forum software versions prior to 1.8.40
MyBB contact.php Contact module
Deployments accepting user-supplied from parameter or Referer header input

Discovery Timeline

2026-08-18 - CVE-2026-45118 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45118

Vulnerability Analysis

The vulnerability exists in MyBB's contact.php Contact module. The script reads a redirect target from either $mybb->input['from'] (populated by the from HTTP parameter) or $_SERVER['HTTP_REFERER']. It then passes this value directly to the redirect() function without validating the URL scheme or destination.

Because the $force_redirect variable is set to true, MyBB renders a fallback link labeled Click here if you don't want to wait any longer that points to the attacker-controlled target. When the target uses a javascript: URI, clicking the link executes attacker-supplied JavaScript in the origin of the vulnerable MyBB forum.

This dual behavior produces both an open redirect and reflected cross-site scripting (XSS). The XSS variant is more severe because it runs in the authenticated user's browser context, allowing theft of session cookies, cross-site request forgery against forum actions, and defacement of user-visible content.

Root Cause

The root cause is missing scheme allow-listing and destination validation in the redirect logic. The application trusts the from parameter and Referer header as safe navigation targets. It does not restrict redirects to same-origin HTTP or HTTPS URLs, nor does it reject dangerous URI schemes such as javascript:, data:, or vbscript:.

Attack Vector

An attacker crafts a URL that submits contact.php with a from parameter containing a javascript: payload, or induces the victim's browser to send a manipulated Referer header. The victim visits the link, sees the intermediate redirect page, and clicks the Click here if you don't want to wait any longer link. The browser then evaluates the attacker's JavaScript in the context of the MyBB forum domain. Exploitation requires user interaction but no authentication.

The vulnerability manifests in the redirect handling path of contact.php. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-45118

Indicators of Compromise

Requests to /contact.php containing from=javascript: or URL-encoded variants such as from=javascript%3A in query strings or POST bodies
HTTP requests to contact.php with a Referer header value that begins with javascript:, data:, or other non-HTTP schemes
Web server access logs showing outbound redirect responses from contact.php pointing to external or suspicious destinations
Unusual session activity or cookie-stealing callbacks originating from users who recently visited crafted contact.php links

Detection Strategies

Deploy web application firewall (WAF) rules that block requests to contact.php where the from parameter or Referer header contains non-http/https schemes
Review historical access logs for anomalous from parameter values on the contact.php endpoint
Correlate phishing report data with forum referrer patterns to identify targeted exploitation campaigns

Monitoring Recommendations

Alert on any HTTP 302 response from contact.php where the Location header contains a non-HTTP scheme
Monitor for spikes in traffic to contact.php originating from external referrers or shortened URLs
Track authenticated forum accounts that exhibit session activity from new IP addresses shortly after visiting contact.php

How to Mitigate CVE-2026-45118

Immediate Actions Required

Upgrade MyBB to version 1.8.40 or later, which contains the vendor fix for this vulnerability
Audit web server and application logs for prior exploitation attempts against contact.php
Notify forum users to reset passwords if evidence of session hijacking or account compromise is found

Patch Information

MyBB released version 1.8.40 which addresses this vulnerability by validating the redirect target and rejecting non-HTTP schemes. Refer to the MyBB 1.8.40 Release Notes and the MyBB Version Release page for upgrade instructions and full change details.

Workarounds

Restrict access to contact.php at the reverse proxy or WAF layer until the upgrade is deployed
Add WAF signatures to block requests where the from parameter or Referer header contains javascript:, data:, or vbscript: schemes
Temporarily disable the Contact module in the MyBB Admin Control Panel if it is not required for site operations

bash

# Example WAF rule (ModSecurity) to block dangerous schemes on contact.php
SecRule REQUEST_URI "@contains /contact.php" \
    "chain,phase:2,deny,status:403,id:1004511,msg:'MyBB CVE-2026-45118 open redirect / XSS attempt'"
    SecRule ARGS:from|REQUEST_HEADERS:Referer "@rx (?i)^(javascript|data|vbscript):" \
        "t:none,t:urlDecodeUni"