{"id":"CVE-2026-45129","title":"MyBB is free and open source forum software","summary":"MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafte…","severity":"medium","cvss":4.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","cwe":["CWE-352"],"published":"2026-08-18","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:02:26.047","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45129","references":[{"url":"https://github.com/mybb/mybb/commit/d2d9e47b53d85101cf25cb47e882bc7ba76355a4","label":"security-advisories@github.com"},{"url":"https://github.com/mybb/mybb/releases/tag/mybb_1840","label":"security-advisories@github.com"},{"url":"https://github.com/mybb/mybb/security/advisories/GHSA-75vg-6wgp-mcc9","label":"security-advisories@github.com"},{"url":"https://mybb.com/versions/1.8.40","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00139,"epssPercentile":0.03624,"ingestedAt":"2026-09-08T21:11:12.280Z","slug":"CVE-2026-45129","body":"## Overview\n\nMyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}