CVE-2026-45129

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.40

Description The Admin CP Recovery Codes module fails to validate requests properly, enabling same-site attackers to rotate an administrator's recovery codes using a specially crafted URL. The issue occurs on the Admin CP Home, Preferences, Recovery Codes page when the action=recovery codes parameter is used, as it regenerates Two-Factor Authentication recovery codes in mybb adminoptions.recovery codes via GET requests without request forgery protection. This behavior is linked to the admin/modules/home/preferences.php file.

Recommendations Update to version 1.8.40.