CVE-2026-45118

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The Contact module fails to correctly validate the redirect URL or protocol. The contact.php endpoint accepts a redirect target via the from HTTP parameter or the HTTP REFERER header and passes it to the redirect() function without sufficient verification. This allows an open redirect and reflected JavaScript code injection, where a javascript: URI can be injected into the link provided to the user, leading to script execution when the link is clicked.

Recommendations Update to version 1.8.40.