Description

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $_SERVER['HTTP_REFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don't want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-18T16:17:06.633Z",
  "pubdate": "2026-08-18T16:17:06.633Z",
  "executiveSummary": "A vulnerability exists in the MyBB forum software prior to version 1.8.40 within the Contact module, specifically allowing for open redirection and reflected JavaScript code injection.\nThe flaw allows unauthenticated remote attackers to craft malicious links or redirect targets that can lead users to arbitrary external sites or execute arbitrary JavaScript code within the context of the victim's browser session.\nThe risk implications include potential phishing attacks, session hijacking, or malicious script execution against unsuspecting users who interact with the application.\nExploitation requires a victim to interact with the application by selecting a specifically manipulated link where the application forces a redirect using unvalidated input.\nThe issue stems from improper validation of redirect URLs and protocols accepted via HTTP parameters or headers, which are subsequently passed directly to redirection handling functions.",
  "technicalDetails": "The root cause of the vulnerability resides in the Contact module of MyBB, specifically within contact.php, where the application fails to adequately validate the redirect URL or protocol supplied by the client.\nThe application accepts the redirect target from the from HTTP parameter via $mybb->input['from'] or alternatively from the Referer HTTP header via $_SERVER['HTTP_REFERER'].\nThis unvalidated input is subsequently passed directly to the redirect() function without sufficient security verification.\nBecause the $force_redirect variable evaluates to true during this process, a javascript: URI supplied by an attacker becomes the direct target of the 'Click here if you don't want to wait any longer' hyperlink rendered to the user.\nWhen a victim selects this generated link, the browser executes the embedded JavaScript code, leading to reflected script execution within the victim's browser session.\nThe attack flow involves an attacker inducing a victim to visit a specially crafted URL or trigger a request containing a malicious javascript: URI or external redirect target in the vulnerable parameters or headers.\nThe vulnerable component is the Contact module handled by contact.php in MyBB versions prior to 1.8.40.\nThe vulnerability requires no authentication or special privileges, is exploitable over the network, and relies on user interaction via link selection to execute the payload."
}