CyberRota Analysis
AI-GeneratedThe Admin CP Recovery Codes module in MyBB prior to version 1.8.40 is vulnerable to improper request validation, allowing same-site attackers to rotate an administrator's Two-Factor Authentication recovery codes via a crafted URL. This could lead to unauthorized access and potential compromise of administrative accounts. Administrators using affected versions should prioritize updating to 1.8.40 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40.