Description

### Impact The registration component does not validate the text-based _Security Question_ CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) ### Details The public _Registration_ workflow ([`member.php?action=do_register`](https://github.com/mybb/mybb/blob/mybb_1839/member.php#L262-L307)) accepts a hidden field `question_id` — expected to match the question session identifier (`mybb_questionsessions.sid`) — and validates the challenge answer without a fail-closed fallback for invalid identifiers. If the value is blank, forged, or expired, the request continues without a question-related error. ### Patches MyBB 1.8.(...) resolves this issue with the following changes: - Commit: https://github.com/mybb/mybb/commit/ - `.patch`: https://github.com/mybb/mybb/commit/.patch ### References - Release Notes: https://mybb.com/versions/1.8.(...)/ ### For more information Go to [mybb.com/security](https://mybb.com/security/) to report possible security concerns or to learn more about security research at MyBB. ### Contact The security team can be reached at [security@mybb.com](mailto:security@mybb.com).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T16:17:09.350Z",
  "pubdate": "2026-08-18T16:17:09.350Z",
  "executiveSummary": "A security vulnerability has been identified in the registration component of MyBB, specifically related to the validation mechanism of the text-based security question CAPTCHA. The flaw allows unauthenticated remote attackers to bypass the CAPTCHA challenge entirely by supplying a specially crafted or manipulated value within the submission workflow.\nThe vulnerability directly impacts the integrity of the user registration process, potentially enabling automated systems, bots, and malicious actors to create unauthorized accounts at scale. Because the system fails to enforce a secure-by-default stance when evaluating challenge identifiers, malicious submissions can proceed without validating the correctness of the answer or the validity of the associated session.\nThe affected product is MyBB, specifically versions prior to the provided security patch. Exploitation of this vulnerability requires network access to the public-facing registration endpoint (`member.php?action=do_register`) and does not require any prior authentication, user interaction, or elevated privileges. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, resulting in a low severity impact limited to integrity bypass without compromising confidentiality or availability.",
  "technicalDetails": "The vulnerability resides within the public registration workflow of MyBB, specifically handled in `member.php?action=do_register` (referenced at `member.php?L262-L307`). During the registration process, the application implements a text-based security question CAPTCHA designed to differentiate human users from automated scripts.\nThe root cause of the vulnerability stems from improper input validation and an absence of a fail-closed architecture when processing the hidden `question_id` field. This field is expected to correspond directly to a valid question session identifier stored in the database (`mybb_questionsessions.sid`).\nWhen a registration request is submitted, the backend logic attempts to validate the user's answer against the corresponding session identifier. However, if an attacker supplies a blank, forged, or expired `question_id` value, the validation logic fails to enforce a secure fallback. Instead of rejecting the request due to an invalid or missing session identifier, the application allows the execution flow to continue without triggering a question-related validation error.\nThe attack flow proceeds as follows: First, an unauthenticated attacker navigates to the public registration page without completing the proper security question challenge. Second, the attacker crafts an HTTP POST request targeting `member.php?action=do_register`. Third, the attacker manipulates the `question_id` parameter by omitting it, supplying an arbitrary string, or referencing an expired session identifier. Fourth, the server-side validation routine evaluates the manipulated parameter, fails to handle the anomalous input securely, and bypasses the CAPTCHA check. Finally, the account registration is successfully processed without verifying the challenge answer.\nThe vulnerability requires no authentication or privileges, is exploitable remotely over the network, and involves no user interaction. The post-exploitation impact is strictly restricted to unauthorized registration bypass, allowing potential bulk account creation or automated abuse of the registration interface."
}