Description

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the MyBB Default CAPTCHA selected by the captchaimage setting. A valid response can therefore be reused until a non-vulnerable endpoint invalidates it, an incorrect response is submitted, or the challenge expires. This issue is fixed in version 1.8.40.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T16:17:08.980Z",
  "pubdate": "2026-08-18T16:17:08.980Z",
  "executiveSummary": "A challenge replay vulnerability exists within the built-in CAPTCHA implementation of MyBB prior to version 1.8.40. The security flaw stems from a failure to consistently enforce single-use semantics on CAPTCHA challenge responses across several sensitive functional endpoints. Specifically, successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend fail to invoke the necessary invalidation logic for the MyBB Default CAPTCHA.\nConsequently, remote attackers can bypass bot mitigation controls through challenge replay. A single valid CAPTCHA response can be repeatedly harvested and reused across vulnerable endpoints until the challenge expires, an incorrect response is submitted, or an endpoint that properly invalidates the challenge is executed. The business impact includes automated abuse such as spam transmission, brute-force password resets, mass activation requests, and unauthorized form submissions. Exploitation requires network access to the target forum application and allows remote unauthenticated attackers to subvert automated abuse prevention mechanisms.",
  "technicalDetails": "The vulnerability resides in the CAPTCHA handling architecture of MyBB prior to version 1.8.40, specifically concerning the MyBB Default CAPTCHA selected via the captchaimage configuration setting. The root cause of the flaw is the omission of the captcha::invalidate_captcha() function call within the validation code paths of multiple functional scripts.\nWhen a user submits a form containing a CAPTCHA response, the application evaluates the correctness of the input. In secure implementations, a successfully validated CAPTCHA challenge token is immediately invalidated to prevent subsequent reuse. However, in the vulnerable endpoints—namely contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend—the validation logic verifies the input without enforcing single-use semantics by destroying or expiring the underlying challenge state.\nThe attack flow proceeds as follows: An attacker initiates a legitimate interaction with the forum to solve a single CAPTCHA challenge, capturing the valid response parameter and associated challenge identifiers via automated scripts or manual interception. Rather than discarding this token upon use, the attacker crafts multiple automated HTTP POST requests targeting any of the aforementioned vulnerable endpoints. Because the backend application logic fails to execute captcha::invalidate_captcha() upon successful validation, the identical CAPTCHA challenge response is repeatedly accepted by the server.\nThis replay capability persists across requests until one of three conditions is met: a non-vulnerable endpoint that properly invalidates the challenge is accessed, an incorrect response is explicitly submitted to invalidate the state, or the underlying challenge mechanism expires based on time-to-live configurations. The attack vector is entirely network-based, requires no prior authentication or privileged access, and enables threat actors to automate high-volume actions such as password resets and contact form spamming, effectively bypassing the intended security controls."
}