CVE-2026-45123: MyBB Forum Software SSRF Vulnerability

CVE-2026-45123 Overview

CVE-2026-45123 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in MyBB, an open source forum software. Versions prior to 1.8.40 do not correctly handle IPv6 addresses in the remote requests feature. The default disallowed_remote_addresses configuration lists only IPv4 ranges, and the host verification logic in fetch_remote_file() fails open when get_ip_by_hostname() returns no result. Since get_ip_by_hostname() does not return IPv6 records, an attacker with low-privileged access can craft a remote target that bypasses the host restriction. The issue is fixed in MyBB 1.8.40.

Critical Impact
An authenticated attacker can coerce the MyBB server into issuing HTTP requests to internal IPv6 endpoints, exposing internal network services and metadata resources.

Affected Products

MyBB forum software versions prior to 1.8.40
Deployments using the remote requests feature (fetch_remote_file())
MyBB instances relying on default disallowed_remote_addresses configuration

Discovery Timeline

2026-08-18 - CVE-2026-45123 published to NVD
2026-08-18 - Last updated in NVD database
1.8.40 release - MyBB releases patched version addressing the IPv6 SSRF via GitHub Security Advisory GHSA-56wr-64wx-5g7j

Technical Details for CVE-2026-45123

Vulnerability Analysis

The vulnerability resides in inc/functions.php within the fetch_remote_file() function. MyBB resolves the target host with get_ip_by_hostname() and compares the result against the disallowed_remote_addresses list. When the hostname resolves only to IPv6 records, get_ip_by_hostname() returns an empty result. The original code did not treat this as a failure, allowing execution to continue past the host restriction check. This fail-open behavior enables SSRF against IPv6-reachable internal targets. The attacker requires low-privilege authenticated access, which matches functionality such as avatar fetching or other user-triggered remote requests.

Root Cause

Two defects combine to produce the SSRF condition. First, get_ip_by_hostname() resolves only IPv4 addresses and returns an empty array for IPv6-only hosts. Second, the calling code in fetch_remote_file() did not validate whether resolution succeeded before proceeding. Additionally, the default disallowed_remote_addresses array lacked IPv6 CIDR entries such as loopback (::1), unique local addresses (fc00::/7), and link-local addresses (fe80::/10).

Attack Vector

An attacker submits a URL pointing to an attacker-controlled hostname that resolves only to an IPv6 address, or directly to an IPv6 literal. The MyBB server calls fetch_remote_file(), resolution returns empty, the disallow check is skipped, and the underlying HTTP client issues a request to the IPv6 target. This exposes internal services accessible over IPv6, including link-local metadata and loopback interfaces.

php

// Patch in inc/functions.php - fail-closed on empty resolution
$addresses = get_ip_by_hostname($url_components['host']);
+
+if(empty($addresses))
+{
+    return false;
+}
+
$destination_address = $addresses[0];

if(!empty($config['disallowed_remote_addresses']))

Source: GitHub Commit 9cdadbf

Detection Methods for CVE-2026-45123

Indicators of Compromise

Outbound HTTP requests from the MyBB PHP process to IPv6 loopback (::1), unique local (fc00::/7), or link-local (fe80::/10) addresses
Web server access logs showing user-submitted URLs containing IPv6 literals in bracketed notation (for example, http://[::1]/)
MyBB requests to hostnames that resolve exclusively to AAAA records with no A record

Detection Strategies

Inspect PHP-FPM or web server egress logs for connections initiated by MyBB toward internal IPv6 ranges
Correlate forum activity (avatar changes, remote image inclusion, feed fetching) with anomalous outbound requests
Deploy WAF rules that flag or block user input containing IPv6 URL literals to MyBB endpoints that trigger remote fetches

Monitoring Recommendations

Enable verbose logging on the reverse proxy or PHP HTTP client to capture destination hosts of remote fetches
Monitor DNS query logs for AAAA-only resolutions initiated by MyBB servers
Alert on any request from web application servers to cloud metadata endpoints reachable via IPv6

How to Mitigate CVE-2026-45123

Immediate Actions Required

Upgrade MyBB to version 1.8.40 or later using the MyBB 1.8.40 release notes
Restrict outbound network access from the MyBB server to only required destinations, blocking internal IPv6 ranges at the host or network firewall
Review the disallowed_remote_addresses configuration to confirm the updated IPv6 entries are present after upgrade

Patch Information

The fix is delivered in MyBB 1.8.40 via commit 9cdadbf66f4cef50019f13aaa8e3470ea6535cb7. The patch adds a fail-closed check in fetch_remote_file() when get_ip_by_hostname() returns empty, and extends disallowed_remote_addresses to include IPv6 CIDR ranges. See the GitHub Security Advisory GHSA-56wr-64wx-5g7j for full details.

Workarounds

If patching is delayed, disable or restrict remote request features that call fetch_remote_file() such as remote avatars
Add host-level firewall rules that block outbound IPv6 traffic from the web server to private and loopback ranges
Manually extend the disallowed_remote_addresses array in the MyBB configuration with IPv6 entries listed in the upstream patch

php

// Configuration example - updated disallowed_remote_addresses
$config['disallowed_remote_addresses'] = array(
    '0.0.0.0',
    '10.0.0.0/8',
    '100.64.0.0/10',
    '127.0.0.0/8',
    '169.254.0.0/16',
    '172.16.0.0/12',
    '192.168.0.0/16',
    '255.255.255.255',
    '::',
    '::1',
    '::ffff:0:0/96',
    'fc00::/7',
    'fe80::/10',
    'ff00::/8',
);