CVE-2026-45129: MyBB Admin Recovery Codes CSRF Vulnerability

CVE-2026-45129 Overview

CVE-2026-45129 is a Cross-Site Request Forgery (CSRF) vulnerability in MyBB, an open source forum software package. The flaw exists in the Admin CP Recovery Codes module (admin/modules/home/preferences.php), which regenerates Two-Factor Authentication (2FA) recovery codes on GET requests without request forgery protection. A same-site attacker can craft a URL that, when loaded by an authenticated administrator, rotates the victim's 2FA recovery codes stored in mybb_adminoptions.recovery_codes. The issue is fixed in MyBB version 1.8.40 and is tracked under [CWE-352].

Critical Impact
An authenticated administrator visiting a malicious URL has their 2FA recovery codes silently regenerated, undermining account recovery integrity.

Affected Products

MyBB forum software versions prior to 1.8.40
admin/modules/home/preferences.php (Admin CP Home, Preferences, Recovery Codes module)
mybb_adminoptions.recovery_codes database field

Discovery Timeline

2026-08-18 - CVE-2026-45129 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45129

Vulnerability Analysis

The MyBB Admin CP exposes an action=recovery_codes handler under the Home > Preferences module. This endpoint calls generate_recovery_codes() and issues an UPDATE against the adminoptions table on every request, including simple GET requests. The handler contains no anti-CSRF token check, no verification of the HTTP method, and no confirmation step before mutation.

A same-site attacker can host or inject a resource that triggers a request to the vulnerable URL. When an authenticated administrator loads that resource, their session cookie is transmitted, and the endpoint rotates the recovery codes bound to their uid. The attacker does not learn the new codes, but the legitimate administrator loses access to any previously stored recovery codes. This creates an availability and integrity impact on the account recovery workflow.

Root Cause

The root cause is a missing state-changing request protection in admin/modules/home/preferences.php. State-mutating operations must require a POST request and a verified CSRF token. The pre-1.8.40 code path performed the destructive generate_recovery_codes() and $db->update_query("adminoptions", ...) operations unconditionally at controller entry, before any method or token check.

Attack Vector

Exploitation requires an authenticated MyBB administrator session and user interaction, such as clicking a link or loading an attacker-controlled page in the same browser. Any HTML tag capable of issuing a GET request to index.php?module=home-preferences&action=recovery_codes on the target forum will trigger the rotation.

php

// Patch from admin/modules/home/preferences.php (MyBB 1.8.40)
$page->add_breadcrumb_item($lang->recovery_codes, "index.php?module=home-preferences&action=recovery_codes");

-	// First: regenerate the codes
-	$codes = generate_recovery_codes();
-	$db->update_query("adminoptions", array("recovery_codes" => $db->escape_string(my_serialize($codes))), "uid='{$mybb->user['uid']}'");
+	// User clicked no
+	if($mybb->get_input('no'))
+	{
+		admin_redirect("index.php?module=home-preferences");
+	}

-	// And now display them
-	$page->output_header($lang->recovery_codes);
+	if($mybb->request_method == "post")
+	{
+		// First: regenerate the codes
+		$codes = generate_recovery_codes();
+		$db->update_query("adminoptions", array("recovery_codes" => $db->escape_string(my_serialize($codes))), "uid='{$mybb->user['uid']}'");

-	$table = new Table;
-	$table->construct_header($lang->recovery_codes);
+		$page->output_header($lang->recovery_codes);
+		$table = new Table;
+		$table->construct_header($lang->recovery_codes);

The patch wraps the destructive operation in a $mybb->request_method == "post" check and adds a confirmation dialog with a no cancel path. Source: MyBB commit d2d9e47.

Detection Methods for CVE-2026-45129

Indicators of Compromise

Unexpected changes to the recovery_codes column in the mybb_adminoptions table for administrator accounts.
Administrator reports that stored 2FA recovery codes no longer function after visiting an external link or a forum page containing untrusted content.
Web server access logs containing GET requests to index.php?module=home-preferences&action=recovery_codes with cross-site Referer headers.

Detection Strategies

Audit web server logs for GET requests to the home-preferences module with the recovery_codes action, correlating source IP and Referer values against expected administrator activity.
Enable database write auditing on the adminoptions table and alert on updates to recovery_codes outside of intentional administrator sessions.
Deploy a Web Application Firewall (WAF) rule that flags requests to action=recovery_codes lacking a valid Origin or Referer matching the forum host.

Monitoring Recommendations

Monitor for repeated or automated requests to Admin CP endpoints that use GET for state-changing operations.
Track version banners across MyBB deployments to identify instances still running versions prior to 1.8.40.
Alert on administrator session activity originating from newly seen IP addresses or user-agents.

How to Mitigate CVE-2026-45129

Immediate Actions Required

Upgrade MyBB to version 1.8.40 or later, which introduces POST-method enforcement and a confirmation prompt on the recovery codes handler.
Instruct administrators to regenerate and securely re-store their 2FA recovery codes after applying the update.
Review recent access logs for suspicious GET requests to index.php?module=home-preferences&action=recovery_codes.

Patch Information

The fix is delivered in MyBB 1.8.40 via commit d2d9e47b53d85101cf25cb47e882bc7ba76355a4. See the MyBB 1.8.40 release, the GitHub Security Advisory GHSA-75vg-6wgp-mcc9, and the MyBB 1.8.40 version notes for full details.

Workarounds

Restrict Admin CP access to trusted source IP addresses using web server or firewall rules until the patch is applied.
Require administrators to use a separate browser or private session dedicated to Admin CP access, reducing same-site exposure to malicious pages.
Configure a reverse proxy or WAF to block GET requests to action=recovery_codes and require POST with a valid same-origin Referer.

bash

# Example nginx rule to block GET requests to the vulnerable endpoint pre-patch
location ~* /admin/index\.php {
    if ($request_method = GET) {
        set $block "";
        if ($arg_module = "home-preferences") { set $block "${block}M"; }
        if ($arg_action = "recovery_codes") { set $block "${block}A"; }
        if ($block = "MA") { return 403; }
    }
}