Description
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $_SERVER['HTTP_REFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don't want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40.
Published: 2026-08-18
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is in MyBB's Contact module before version 1.8.40. It accepts a redirect target from the HTTP 'from' parameter or the Referer header without validating the URL scheme or path. An attacker can supply a javascript: URI, which becomes the target of a link displayed on the page. When a user clicks the link, the supplied JavaScript runs in their browser, allowing reflected XSS.

Affected Systems

All installations of MyBB forum software running a version earlier than 1.8.40 are affected. This includes community‑hosted and self‑hosted deployments that have not applied the 1.8.40 release, which contains the fix. No other vendors or products are listed as affected.

Risk and Exploitability

The CVSS score of 9.3 reflects a high‑severity client‑side flaw. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack can be triggered remotely via a crafted link without authentication, and the reflected JavaScript executes in the victim’s browser. The impact is therefore limited to the user’s session when the attack link is followed.

Generated by OpenCVE AI on August 18, 2026 at 18:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade MyBB to version 1.8.40 or later, which removes the improper redirect handling.
  • If an immediate upgrade is not possible, configure the application or web server to reject javascript: and other non‑HTTP URI schemes in the redirect target on the Contact page.
  • Apply a Content‑Security‑Policy header that disallows inline script execution or restricts script sources to trusted domains to mitigate the impact of any potential XSS injection.

Generated by OpenCVE AI on August 18, 2026 at 18:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Mybb
Mybb mybb
Vendors & Products Mybb
Mybb mybb

Tue, 18 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Description MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $_SERVER['HTTP_REFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don't want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40.
Title MyBB: Contact page reflected XSS
Weaknesses CWE-83
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'}

Subscriptions

Mybb Mybb
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T17:52:25.117Z

Reserved: 2026-05-08T20:08:17.207Z

Link: CVE-2026-45118

cve-icon Vulnrichment

Updated: 2026-08-18T17:52:22.512Z

cve-icon NVD

Status : Received

Published: 2026-08-18T16:17:06.633

Modified: 2026-08-18T18:17:34.997

Link: CVE-2026-45118

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T18:45:03Z

Weaknesses
  • CWE-83

    Improper Neutralization of Script in Attributes in a Web Page