CVE-2026-39912
published 2026-04-09CVE-2026-39912: V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the…
PriorityP267critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.58%
43.5th percentile
V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cedar2025 | xboard | <= 0.1.9 | — |
| v2board | v2board | 1.6.1 – 1.7.4 | — |
| v2board | v2board | bdb10bed32c5f37df2f0872c3cb354e9b7a293bd – 0ca47622a50116d0ddd7ffb316b157afb57d25e8 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.09.1CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-83h9-46h8-whf4: V2Board 1
ghsa_unreviewed·2026-04-09
CVE-2026-39912 [CRITICAL] CWE-201 GHSA-83h9-46h8-whf4: V2Board 1
V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.
VulDB
v2board/Xboard WithMailLink Endpoint login_with_mail_link_enable insertion of sensitive information into sent data
vuldb·2026-04-09·CVSS 9.1
CVE-2026-39912 [CRITICAL] v2board/Xboard WithMailLink Endpoint login_with_mail_link_enable insertion of sensitive information into sent data
A vulnerability categorized as critical has been discovered in v2board and Xboard. This affects the function login_with_mail_link_enable of the component WithMailLink Endpoint. Such manipulation leads to insertion of sensitive information into sent data.
This vulnerability is uniquely identified as CVE-2026-39912. The attack can be launched remotely. No exploit exists.
Applying a patch is advised to resolve this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Http/Controllers/V1/Passport/AuthController.php#L51https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Services/Auth/MailLinkService.php#L49https://github.com/cedar2025/Xboard/commit/121511523f04882ec0c7447acd9b8ebcb8a47957https://github.com/cedar2025/Xboard/pull/873https://github.com/v2board/v2board/blob/0ca47622a50116d0ddd7ffb316b157afb57d25e8/app/Http/Controllers/Passport/AuthController.php#L71https://github.com/v2board/v2board/pull/981https://www.vulncheck.com/advisories/v2board-xboard-authentication-token-exposure-via-loginwithmaillink
2026-04-09
Published