Open Redirect and Code Injection in MyBB Forum Software
CVE-2026-45118

9.3CRITICAL

Key Information:

Vendor

Mybb

Status
Mybb
Vendor
CVE Published:
18 August 2026

What is CVE-2026-45118?

MyBB, a free and open source forum software, has a vulnerability in its Contact module prior to version 1.8.40. The issue arises because the software fails to validate a redirect URL or protocol correctly, allowing for an open redirect vulnerability and reflected JavaScript code injection. The potential risk occurs when contact.php accepts a target redirect URL from either the HTTP parameter or the Referer HTTP header and forwards it to the redirect() function without adequate checks. This could allow an attacker to inject a malicious javascript: URI, leading to script execution if a victim clicks on the Click here if you don't want to wait any longer link. This vulnerability is effectively mitigated in version 1.8.40.

Affected Version(s)

mybb < 1.8.40

References

https://github.com/mybb/mybb/security/advisories/GHSA-wf9...
x_refsource_CONFIRM
https://github.com/mybb/mybb/releases/tag/mybb_1840
x_refsource_MISC
https://mybb.com/versions/1.8.40
x_refsource_MISC

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.