CVE-2026-45734

CVE-2026-45734 is a CAPTCHA replay vulnerability in MyBB affecting five endpoints across three files. The root cause is straightforward: the codebase requires two separate calls to complete a CAPTCHA transaction — `validate_captcha()` to check the challenge, then `invalidate_captcha()` to consume it. The second call is optional at the API level. The code works fine without it. That's the problem. When validation succeeds without invalidation, the same CAPTCHA token remains valid for subsequent requests. An attacker can capture a valid token from a public form and replay it indefinitely. The CVSS of 5.3 reflects the technical scope, but it understates the exposure: a forum's CAPTCHA protects registration, password reset, and contact forms. The replay window compounds silently across user onboarding cycles — there is no error, no segfault, no log entry. The vulnerability produces zero signal while accumulating victims. The scope matters. Five endpoints across three files all exhibit the same gap. This isn't one developer forgetting one call — it's a pattern that propagated because the API design makes forgetting the path of least resistance. The two-call lifecycle (validate + invalidate) is a documented antipattern in PHP application security; it has appeared in WordPress plugins, phpBB extensions, and Drupal modules. Independent developers keep making the same mistake because the API keeps presenting the same trap. What you should do: audit your codebase for any CAPTCHA validation that doesn't immediately consume the challenge. If you're using MyBB 1.8.40 or later, verify that the fix actually refactored the API to enforce atomic consumption rather than just adding five missing invalidation calls. The distinction matters — if it's just added calls, every future endpoint developer inherits the same vulnerability. If the API now handles invalidation internally, the pattern is corrected. Check the commit diff to confirm which approach was taken. More broadly, this vulnerability is a design debt problem. The CAPTCHA API was likely built with an implicit trust assumption that replay wasn't a threat, or that invalidation was optional for benign use cases. That assumption decayed silently. The fix closes the door, but if the underlying API still rewards forgetting, the next endpoint will face the same temptation. Consider whether your CAPTCHA library provides any signal — a warning, a log entry, a return value requiring acknowledgment — when validation completes without consumption. Silence is what let this persist.

Reviewed through automated stages and approved by a human before publication.