The flaw resides in MyBB’s Admin CP Recovery Codes page, where a GET request to the recovery_codes action regenerates two‑factor authentication recovery codes without any CSRF protection. An attacker can send a malicious URL that triggers this GET request, causing the victim administrator’s recovery codes to be replaced. Because the new codes overwrite the old ones, the administrator loses trusted backup codes, potentially crippling 2‑factor authentication and creating a path for subsequent compromise. The vulnerability is characterised as a Cross‑Site Request Forgery (CWE‑352) and is rated as moderate severity by CVSS.

Installations of MyBB released before version 1.8.40 are affected, particularly those that enable the Admin CP Recovery Codes module and lack CSRF token enforcement on the preferences page (admin/modules/home/preferences.php). The issue was addressed in MyBB 1.8.40, as documented by the commit and release notes linked in the advisory.

The CVSS score of 4.6 indicates moderate risk. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The likely attack vector is a same‑site request or embedded link that forces the adapter to regenerate recovery codes. An attacker only needs to get the administrator to visit the crafted URL or have the link embedded in content that the admin will view; no additional privileges are required. Successful exploitation leads to deletion of the admin’s existing recovery codes, hindering the administrator’s ability to authenticate via 2‑factor recovery ranges and creating a facilitation for account takeover if the attacker can obtain the new codes.