CVE-2026-46482: CAPTCHA Authentication Bypass Vulnerability

CVE-2026-46482 Overview

CVE-2026-46482 is a CAPTCHA bypass vulnerability in MyBB, an open-source forum software. The registration workflow in member.php fails to validate the text-based Security Question CAPTCHA correctly. Attackers can bypass the challenge by supplying a specially crafted question_id value in the registration request.

The flaw is categorized under [CWE-636] (Not Failing Securely / "Failing Open"). It allows unauthenticated remote actors to register accounts without solving the anti-automation challenge, undermining bot-registration defenses.

Critical Impact
Unauthenticated attackers can automate account registration by bypassing the Security Question CAPTCHA, enabling spam, credential stuffing, and abuse of forum resources.

Affected Products

MyBB forum software versions prior to 1.8.40
MyBB registration component (member.php?action=do_register)
Installations relying on the text-based Security Question CAPTCHA

Discovery Timeline

2026-08-18 - CVE-2026-46482 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-46482

Vulnerability Analysis

The public Registration workflow accepts a hidden question_id field expected to match a session identifier stored in mybb_questionsessions.sid. The handler validates the submitted answer against the referenced question but omits a fail-closed branch when the identifier is blank, forged, or expired.

When the question_id does not correspond to a live session row, the challenge lookup silently returns no record. Execution proceeds through the registration flow without appending a question-related error to the $errors array. The account creation continues as if the CAPTCHA had been solved.

This behavior weakens registration-time bot mitigation. Automated tools can send registration POST requests with an empty or arbitrary question_id and skip the challenge entirely. The impact is limited to integrity of the registration surface, with no direct confidentiality or availability effects.

Root Cause

The root cause is missing negative-path handling in the Security Question verification logic. The code path that deletes a matched question session is not paired with an else clause that raises error_question_wrong when no matching session exists.

Attack Vector

Exploitation is network-based, requires no privileges, and needs no user interaction. An attacker sends a crafted HTTP POST to member.php?action=do_register with a blank or invalid question_id and arbitrary registration fields. The server processes the request without enforcing the CAPTCHA.

php

 			$db->delete_query("questionsessions", "sid='{$question_id}'");
 		}
+		else
+		{
+			$errors[] = $lang->error_question_wrong;
+		}
 	}

 	$regerrors = '';

Source: MyBB commit bd2a3447939d3084a5926dd66ece04649e0e0d60

The patch adds the missing else branch. When no matching question session is found, error_question_wrong is now appended to the errors list, causing the registration to fail closed.

Detection Methods for CVE-2026-46482

Indicators of Compromise

POST requests to member.php?action=do_register containing an empty or non-existent question_id value
Bursts of successful new-account creations from a small set of source IPs within short time windows
Registration events with no preceding GET that would have generated a valid mybb_questionsessions.sid
Newly created accounts exhibiting spam posting or credential-testing behavior shortly after registration

Detection Strategies

Correlate web server access logs for do_register POSTs against prior GETs to the registration page from the same session or IP
Inspect the mybb_questionsessions table for orphaned or missing sid values referenced by successful registrations
Alert on high-velocity registration attempts from single IPs, ASNs, or user-agent strings

Monitoring Recommendations

Ingest MyBB application and web server logs into a centralized analytics platform for behavioral baselining
Track daily registration volume and alert on statistical anomalies against the historical baseline
Monitor account creation events for subsequent low-reputation activity such as URL-laden first posts

How to Mitigate CVE-2026-46482

Immediate Actions Required

Upgrade MyBB to version 1.8.40 or later, which contains the fail-closed validation fix
Audit recent registrations for accounts created without a corresponding valid question session
Rate-limit the member.php?action=do_register endpoint at the reverse proxy or WAF layer

Patch Information

MyBB resolved the issue in release 1.8.40. The fix is tracked in GitHub Security Advisory GHSA-v2h7-4jp7-j6hh and applied via commit bd2a3447939d3084a5926dd66ece04649e0e0d60. Administrators should follow the guidance in the MyBB 1.8.40 release notes.

Workarounds

Disable the text-based Security Question CAPTCHA and enable an alternative challenge such as reCAPTCHA until the patch is applied
Deploy a WAF rule that rejects do_register POST requests missing a non-empty question_id parameter
Require email verification before granting posting privileges to newly registered accounts

bash

# Example WAF rule (ModSecurity) to block registrations with empty question_id
SecRule REQUEST_URI "@contains member.php" \
    "chain,id:1004648,phase:2,deny,status:403,msg:'MyBB registration missing question_id (CVE-2026-46482)'"
    SecRule ARGS:action "@streq do_register" "chain"
    SecRule &ARGS:question_id "@eq 0"