CVE-2026-45734— MyBB: Default CAPTCHA missing invalidation
Quick assessment
Affected
mybb mybb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MyBB是MyBB组织开源的一套用PHP和MySQL开发的免费且基于Web的论坛软件。该软件具有简单易用、支持多国语言、可扩展等特点。 MyBB 1.8.40之前版本存在处理逻辑错误漏洞，该漏洞源于内置CAPTCHA未一致强制一次性使用语义，允许远程攻击者通过挑战重放绕过CAPTCHA控件。
Possible ATT&CK Techniques 1 AI
T1098 · Account Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45734
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MyBB: Default CAPTCHA missing invalidation
Source: CVE Program / CVE List V5
Vulnerability Description
MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the MyBB Default CAPTCHA selected by the captchaimage setting. A valid response can therefore be reused until a non-vulnerable endpoint invalidates it, an incorrect response is submitted, or the challenge expires. This issue is fixed in version 1.8.40.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-837
Source: CVE Program / CVE List V5
Vulnerability Title
MyBB 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MyBB是MyBB组织开源的一套用PHP和MySQL开发的免费且基于Web的论坛软件。该软件具有简单易用、支持多国语言、可扩展等特点。 MyBB 1.8.40之前版本存在处理逻辑错误漏洞，该漏洞源于内置CAPTCHA未一致强制一次性使用语义，允许远程攻击者通过挑战重放绕过CAPTCHA控件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-45734
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45734
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45734 (2)
-
🔗 Release mybb_1840 · mybb/mybb · GitHub x_refsource_MISC
-
Vendor Advisories for CVE-2026-45734 (1)
Vendor Pages for CVE-2026-45734 (1)
Same Patch Batch · mybb · 2026-08-18 · 18 CVEs total
| CVE-2026-45117 | 9.8 CRITICAL | MyBB: Installer database configuration RCE |
| CVE-2026-45118 | 9.3 CRITICAL | MyBB: Contact page reflected XSS |
| CVE-2026-45115 | 8.7 HIGH | MyBB: Buddy/ignore list username XSS |
| CVE-2026-45116 | 8.7 HIGH | MyBB: Profile field type confusion XSS |
| CVE-2026-45120 | 5.4 MEDIUM | MyBB: Insufficient authorization for private calendar events |
| CVE-2026-46482 | 5.3 MEDIUM | MyBB: Security Question insufficient validation |
| CVE-2026-45125 | 5.3 MEDIUM | MyBB: Email User CRLF injection |
| CVE-2026-45119 | 4.6 MEDIUM | MyBB: ACP UTF-8 Conversion CSRF |
| CVE-2026-45129 | 4.6 MEDIUM | MyBB: ACP Recovery Codes CSRF |
| CVE-2026-45123 | 4.3 MEDIUM | MyBB: IPv6 SSRF |
| CVE-2026-45122 | 4.3 MEDIUM | MyBB: Insufficient permission check for calendar event move |
| CVE-2026-45121 | 4.3 MEDIUM | MyBB: Insufficient permission check for calendar select |
| CVE-2026-45124 | 4.3 MEDIUM | MyBB: Mod CP report resolution missing authorization |
| CVE-2026-47245 | 4.3 MEDIUM | MyBB: Buddy list corruption |
| CVE-2026-45126 | 3.5 LOW | MyBB: ACP Questions state CSRF |
| CVE-2026-45128 | 3.5 LOW | MyBB: ACP Users View Manager default CSRF |
| CVE-2026-45127 | 3.5 LOW | MyBB: ACP Mass Mail draft resend CSRF |
IV. Related Vulnerabilities
V. Comments for CVE-2026-45734
No comments yet