This vulnerability in MyBB’s registration workflow allows an attacker to bypass the security question CAPTCHA because the system does not enforce a strict check on the hidden field that stores the question session identifier. As a result, an attacker can submit forged or empty values for the security question, causing the registration process to proceed without verifying the answer. The weakness is categorized as CWE‑636 (Improper Validation of Directives). While the impact on confidentiality is none, the flaw can lead to unauthorized account creation and potential subsequent abuse of those accounts, representing a low integrity compromise in the CVSS 3.1 rating.

The flaw affects MyBB production releases prior to version 1.8.40, including all 1.8.x builds that have not applied the 1.8.40 release or the associated patch commit. Vendors identified include the MyBB community repository. Users of earlier 1.8.x versions who have not yet migrated to 1.8.40 or later are in scope.

The CVSS score of 5.3 indicates a medium severity flaw. The likely attack vector is directly posting to the registration endpoint, and based on the description, it is inferred that no special privileges or UI interaction are required. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the immediate threat level is moderate. The flaw can be leveraged to build a wholesale base of unauthenticated accounts, which can then be used for spam, phishing, or other downstream attacks. Admins should treat this as a reversible risk that can be mitigated by applying the vendor patch.