Description

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-18T16:17:08.223Z",
  "pubdate": "2026-08-18T16:17:08.223Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in MyBB prior to version 1.8.40 within the Admin CP Recovery Codes module. The vulnerability allows same-site attackers to force a victim administrator into rotating their Two-Factor Authentication recovery codes.\nThe flaw affects the Admin CP Home, Preferences, Recovery Codes action=recovery_codes page, which improperly handles state-changing operations via insecure HTTP GET requests lacking proper request forgery protection.\nIf successfully exploited, an attacker can invalidate an administrator's existing recovery codes by leveraging predictable or crafted URLs loaded in the victim's browser session. This can disrupt administrative access or facilitate secondary attacks by breaking legitimate administrative workflows reliant on Multi-Factor Authentication recovery mechanisms.\nThe risk is mitigated by upgrading the MyBB installation to version 1.8.40 or later, which incorporates proper validation and request forgery protections for the affected administrative actions.",
  "technicalDetails": "The root cause of the vulnerability is the lack of request forgery protection, such as anti-CSRF tokens, on state-changing operations within the Admin CP Recovery Codes module. Specifically, the application processes Two-Factor Authentication recovery code regeneration via HTTP GET requests.\nThe vulnerable component is located in the file admin/modules/home/preferences.php, specifically handling the recovery_codes action within the Admin CP Home, Preferences, Recovery Codes page.\nAffected software versions include all MyBB installations prior to version 1.8.40.\nExploitation requires the victim administrator to have an active authenticated session within the Admin CP and to be lured into visiting a specially crafted URL or web page controlled by the same-site attacker. Because the action is performed via a GET request, standard exploitation vectors include embedding the malicious URL within image tags, anchor links, or automated scripts executed in the context of the administrator's authenticated session.\nUpon successful loading of the crafted URL, the application processes the request without validating whether the request was intentionally initiated by the administrator. As a result, the backend regenerates the Two-Factor Authentication recovery codes and updates the mybb_adminoptions.recovery_codes database record accordingly.\nThe post-exploitation impact includes the invalidation of the victim administrator's current recovery codes, potentially locking them out of recovery workflows or forcing reliance on alternative administrative access recovery methods."
}