The MyBB forum software has a flaw in its default CAPTCHA implementation where the captcha is not properly invalidated after a single use. This allows an attacker to replay a valid CAPTCHA response repeatedly on several endpoints, such as contact submission, account activation resend, password recovery, user email and friend‑share forms. The result is that abuse of these functions is possible even though a CAPTCHA is presented, effectively bypassing this important anti‑spam mechanism.

The vulnerability affects MyBB forum installations prior to version 1.8.40. The problem appears in several core files – contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend – when the default CAPTCHA is selected. Upgrading to MyBB 1.8.40 or later applies the necessary invalidation call and removes the issue.

The CVSS base score of 5.3 indicates a moderate severity. No EPSS data is currently available and the issue is not listed in CISA’s KEV catalog. The likely attack vector is remote HTTP request against exposed form endpoints, where an attacker can reuse a previously captured or guessed CAPTCHA value until it expires or an incorrect response is submitted. Mitigation requires applying the vendor’s patch.