MyBB: ACP Recovery Codes CSRF

Description

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.

Scores

EPSS (exploitation in 30 days)

0.18% · top 92% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.6.

Weakness

• CWE-352: Cross-Site Request Forgery (CSRF) (opens in a new tab)All about CWE-352 and its CVEs

Affected products

• mybb · mybb

  • affected < 1.8.40

References (4)

• https://github.com/mybb/mybb/security/advisories/GHSA-75vg-6wgp-mcc9 (opens in a new tab)x_refsource_CONFIRM
• https://github.com/mybb/mybb/commit/d2d9e47b53d85101cf25cb47e882bc7ba76355a4 (opens in a new tab)x_refsource_MISC
• https://github.com/mybb/mybb/releases/tag/mybb_1840 (opens in a new tab)x_refsource_MISC
• https://mybb.com/versions/1.8.40 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-45129](https://trackcve.app/badge/CVE-2026-45129.svg)](https://trackcve.app/cve/CVE-2026-45129)

Record last updated 18 Aug 2026, 18:57 UTC.