CVE-2026-45123 MyBB: IPv6 SSRF
Attackers can bypass host restrictions to perform server-side request forgery against internal IPv6 resources in MyBB forum software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45123?
CVE-2026-45123 is a medium-severity server-side request forgery vulnerability in mybb, published on 18 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40.
Weakness: CWE-918
Which versions are affected by CVE-2026-45123?
How do I fix CVE-2026-45123?
No fix has been published for CVE-2026-45123 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-45123 being exploited?
There is no known exploitation of CVE-2026-45123 in the wild and no public exploit code.
Sources
Also known as GHSA-56wr-64wx-5g7j.