CVE-2026-45734 mybb CVE debrief

Who should care

Defenders responsible for MyBB installations, security teams, and administrators of MyBB-based forums should assess exposure and prioritize verification and patching. This includes reviewing the current CAPTCHA implementation, assessing the potential impact of the vulnerability, and planning for upgrades or mitigations. Additionally, operators and platform administrators should review their systems for potential exposure and take steps to verify and remedi

Why it matters

The CVE-2026-45734 vulnerability in MyBB allows remote attackers to bypass CAPTCHA controls, potentially leading to automated registration and spam, and may allow for brute-force attacks on user accounts. Defenders responsible for MyBB installations, security teams, and administrators of MyBB-based forums should assess exposure and prioritize verification and patching.

• Remote attackers can bypass CAPTCHA controls, potentially leading to automated registration and spam.
• The vulnerability may allow for brute-force attacks on user accounts.
• Verification of CAPTCHA implementation and patching to version 1.8.40 or later is necessary.

Technical summary

The MyBB forum software prior to version 1.8.40 contains a CAPTCHA bypass vulnerability. The built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the MyBB Default CAPTCHA selected by the captchaimage setting.

Defensive priority

Assess exposure, prioritize verification, and apply patches

Recommended defensive actions

• Assess exposure to the vulnerable MyBB versions
• Prioritize verification of CAPTCHA implementation
• Apply patches to upgrade to MyBB version 1.8.40 or later
• Review and update incident response plans
• Verify CAPTCHA implementation in MyBB installations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the CAPTCHA bypass vulnerability in MyBB versions prior to 1.8.40. The issue allows remote attackers to bypass CAPTCHA controls through challenge replay.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.