CVE-2026-45734: MyBB CAPTCHA Auth Bypass Vulnerability

CVE-2026-45734 Overview

MyBB is free and open source forum software widely deployed for community discussion boards. CVE-2026-45734 describes a CAPTCHA bypass flaw in versions prior to 1.8.40. The built-in MyBB Default CAPTCHA fails to enforce single-use semantics on several successful validation paths. Remote attackers can replay a valid CAPTCHA response against multiple endpoints until the challenge expires or an incorrect answer is submitted. The vulnerability is categorized under [CWE-837] Improper Enforcement of a Single, Unique Action. MyBB released version 1.8.40 to address the issue.

Critical Impact
Attackers can bypass CAPTCHA protections on contact, activation resend, password reset, email user, and send-to-friend endpoints, enabling automated abuse such as spam and mass email dispatch.

Affected Products

MyBB forum software versions prior to 1.8.40
Deployments using the MyBB Default CAPTCHA (captchaimage setting enabled)
Endpoints: contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, sendthread.php?action=do_sendtofriend

Discovery Timeline

2026-08-18 - CVE-2026-45734 published to NVD
2026-08-19 - Last updated in NVD database
MyBB 1.8.40 - Patched release published by the MyBB project

Technical Details for CVE-2026-45734

Vulnerability Analysis

The flaw resides in how MyBB validates the Default CAPTCHA on several form submission handlers. When a user submits a correct CAPTCHA response, the affected endpoints proceed with the requested action but never call captcha::invalidate_captcha(). As a result, the CAPTCHA session record remains marked as valid on the server. An attacker who solves the challenge once can resubmit the same session identifier and answer to the same or another affected endpoint. This defeats the anti-automation guarantee that CAPTCHA is designed to provide.

Root Cause

The root cause is a missing invalidation call in the success branches of the affected controllers. The MyBB Default CAPTCHA implementation exposes an invalidate_captcha() method intended to burn the challenge after a single successful verification. The controllers listed in the advisory omit that call when the captchaimage setting selects the Default CAPTCHA. The reCAPTCHA and Are You a Human providers were not affected because their upstream verification services enforce single-use semantics themselves.

Attack Vector

Exploitation requires only network access to a vulnerable MyBB instance. An attacker solves one CAPTCHA challenge, captures the corresponding POST parameters including imagehash and imagestring, and replays them across multiple submissions. The replay is effective until a non-vulnerable endpoint invalidates the challenge, an incorrect response is submitted, or the challenge expires. Typical abuse scenarios include mass contact-form spam, enumeration through the password-reset flow, and automated dispatch of emailuser and sendtofriend messages.

php

// Patch excerpt: contact.php
			$db->insert_query("maillogs", $log_entry);
		}
		
+		// Invalidate solved captcha
+		if($mybb->settings['captchaimage'] && !$mybb->user['uid'])
+		{
+			$captcha->invalidate_captcha();
+		}
+
		$redirect_url = '';
		if(isset($_POST['from']) && is_string($_POST['from']))
		{

// Patch excerpt: member.php do_resendactivation
				}
			}

+			// Invalidate solved captcha
+			if($mybb->settings['captchaimage'])
+			{
+				$captcha->invalidate_captcha();
+			}
+
			$plugins->run_hooks("member_do_resendactivation_end");
			redirect("index.php", $lang->redirect_activationresent);

Source: MyBB commit c2ed54f

Detection Methods for CVE-2026-45734

Indicators of Compromise

Repeated POST requests to contact.php, member.php, or sendthread.php reusing the same imagehash value across multiple submissions.
Elevated volumes of outbound mail generated by maillogs entries tied to a single source IP or narrow IP range.
Anomalous spikes in successful password-reset requests or activation-email resends without corresponding user sessions.

Detection Strategies

Instrument web application logs to alert when identical CAPTCHA session identifiers appear in more than one successful submission.
Correlate maillogs database entries with client IP, User-Agent, and request cadence to identify automated abuse.
Deploy web application firewall rules that fingerprint CAPTCHA parameters and enforce single-use tracking at the proxy layer.

Monitoring Recommendations

Monitor MyBB version strings exposed at /showteam.php and administrator panels to inventory instances still running versions prior to 1.8.40.
Track submission rates against the five affected endpoints and alert on statistical outliers.
Review email delivery logs for spam patterns originating from forum-mediated contact and send-to-friend flows.

How to Mitigate CVE-2026-45734

Immediate Actions Required

Upgrade all MyBB installations to version 1.8.40 or later.
Audit maillogs and mail server records for evidence of prior CAPTCHA replay abuse.
Rotate any administrator credentials that may have been targeted through the password-reset flow.

Patch Information

MyBB 1.8.40 adds explicit captcha::invalidate_captcha() calls to the success branches of contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend. Full details are available in the GitHub Security Advisory GHSA-jrrr-f3jw-mjmc, the GitHub commit, and the MyBB 1.8.40 release notes.

Workarounds

Switch the captchaimage setting to reCAPTCHA or another third-party provider until the upgrade is applied.
Disable the affected endpoints in the Admin Control Panel where business needs allow, for example turning off the contact form and send-to-friend features.
Apply strict rate limiting per IP address at the reverse proxy or WAF for the five affected URLs.

bash

# Example nginx rate limiting for affected endpoints
limit_req_zone $binary_remote_addr zone=mybb_captcha:10m rate=5r/m;

location ~ ^/(contact\.php|sendthread\.php)$ {
    limit_req zone=mybb_captcha burst=3 nodelay;
    proxy_pass http://mybb_backend;
}

location = /member.php {
    if ($arg_action ~ ^(do_resendactivation|do_lostpw|do_emailuser)$) {
        limit_req zone=mybb_captcha burst=3 nodelay;
    }
    proxy_pass http://mybb_backend;
}