External risk intelligence

MyBB Contact Module Open Redirect and JavaScript Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-45118

MyBB is web-based forum software designed to be publicly accessible over the internet to allow user interaction. The vulnerable contact module is a standard feature of this web application, making it a common internet-facing component in standard deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in MyBB forum software could allow an attacker to redirect users to malicious sites and inject JavaScript code, potentially compromising user sessions or information. While the direct business impact requires further assessment of your specific deployment, this type of vulnerability could be used to impersonate legitimate communications or facilitate phishing attacks against your users.

Forum software can redirect users maliciously.
Critical bug affects public-facing communication.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into clicking a crafted link, leading them to a vulnerable forum page. This would allow the attacker to inject malicious JavaScript code that executes in the user's browser when they interact with a specific link on the page.

Requires anonymous user access.
User clicks a malicious link.
Risk of cross-site scripting.

Live Threat

Current exploitation, exposure, and threat context

When MyBB's Contact module is misused, it could allow an attacker to redirect users to a malicious website and potentially inject and execute JavaScript code. This could occur when a user clicks a crafted link, leading to a compromised user experience.

User redirection to malicious sites.
Crafted links trigger script execution.
Compromised user experience.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MyBB's Contact module requires coordination between application owners and potentially network/security teams. The first step is to identify all MyBB installations, determine their reachability and business criticality, and locate the accountable owner. Remediation planning should then be prioritized based on these findings.

Application owners should own this issue.
Verify external reachability and business impact.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MyBB and its role in web forums?

MyBB is a free, open-source platform used to build online discussion boards and community forums. It provides features for user registration, thread management, and communication tools, such as the contact module. These forums are typically hosted on web servers to allow members to interact publicly or within private groups.

What does CWE-83 mean in the context of CVE-2026-45118?

CWE-83 is a weakness classification known as Improper Neutralization of Script Attributes in a Web Page. For this CVE, it means the software fails to properly check if a URL is safe before using it. Because the system trusts user-provided input, an attacker can substitute a standard link with a malicious JavaScript command, causing the browser to execute that code instead of navigating to a safe page.

How is the CVE-2026-45118 vulnerability triggered?

An attacker triggers this by crafting a URL that includes malicious data in the 'from' parameter or the Referer header. The vulnerability is activated specifically when a victim clicks on a 'Click here if you don't want to wait any longer' link generated by the contact module. It is not triggered by simply visiting a page; the user must actively interact with that specific redirect link after the attacker has manipulated the input.

Is my forum instance at risk if it is internet-facing?

According to Halo Surface Signal, this vulnerability is highly relevant if your MyBB instance is publicly accessible, as the contact module is a standard component designed for internet-facing communication. Since the attack requires interaction from a user accessing the site over the network, installations reachable by the public are at a greater risk of being used as a staging ground for these malicious links.

What are the first steps to address this MyBB security issue?

Begin by auditing your infrastructure to identify all active MyBB installations and confirming which versions are currently deployed. Once you have an inventory, prioritize updating any instances running versions prior to 1.8.40 to the patched release. During the transition, notify your team to manage the deployment through your standard maintenance processes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.