CVE-2026-39912

v2board / Xboard Authentication Token Exposure via loginWithMailLink

Published Apr 9, 2026 CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.

Analysis

Technical impact

The loginWithMailLink endpoint returns a full authentication URL that contains an authentication token in the HTTP response body when the login_with_mail_link_enable feature is active. An unauthenticated attacker can submit a known email address to this endpoint and receive a complete login URL. By sending that URL to the token2Login endpoint, the attacker obtains a bearer token that grants full account access, including administrative privileges. The flaw is a direct information‑exposure weakness (CWE‑201).

Affected Systems

Versions of cedar2025 Xboard from 0.1.0 through 0.1.9 and v2board from 1.6.1 through 1.7.4 are affected when the login_with_mail_link_enable feature is enabled.

Risk and Exploitability

The CVSS base score of 9.1 marks the vulnerability as critical. An attacker can exploit it from any network location by simply POSTing a known email address to the loginWithMailLink endpoint; no authentication, special permissions, or code execution are required. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of exposure controls and the ease of obtaining valid tokens make the risk immediate and high.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

v2board

unknown

Version	Status	Constraints
`1.6.1`	affected	≤ 1.7.4
`bdb10bed32c5f37df2f0872c3cb354e9b7a293bd`	affected	≤ 0ca47622a50116d0ddd7ffb316b157afb57d25e8

cedar2025

Xboard

unaffected

Version	Status	Constraints
`0`	affected	≤ 0.1.9
`121511523f04882ec0c7447acd9b8ebcb8a47957`	unaffected	—

No data.

Vendor Product Versions

Cedar2025

Xboard

Version	Status	Scheme	Platform
`[0,0.1.9]`	affected	generic	—
`121511523f04882ec0c7447acd9b8ebcb8a47957`	unaffected	code_commit	—

V2board

Version	Status	Scheme	Platform
`[1.6.1,1.7.4]`	affected	semver	—
`[bdb10bed32c5f37df2f0872c3cb354e9b7a293bd,0ca47622a50116d0ddd7ffb316b157afb57d25e8]`	affected	code_commit	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade v2board to 1.7.5 or later and Xboard to 0.1.10 or later, where the loginWithMailLink endpoint no longer includes the authentication token in the response.
If an upgrade is not possible, disable the login_with_mail_link_enable feature in the configuration to prevent tokens from being exposed.
After disabling or updating, verify that the loginWithMailLink endpoint no longer returns a token or full authentication URL in the HTTP response body.

Generated by OpenCVE AI on April 9, 2026 at 21:36 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.607% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact total

References

Link	Providers
https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/
https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Http/Controllers/V1/Passport/AuthController.php#L51
https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Services/Auth/MailLinkService.php#L49
https://github.com/cedar2025/Xboard/commit/121511523f04882ec0c7447acd9b8ebcb8a47957
https://github.com/cedar2025/Xboard/pull/873
https://github.com/v2board/v2board/blob/0ca47622a50116d0ddd7ffb316b157afb57d25e8/app/Http/Controllers/Passport/AuthController.php#L71
https://github.com/v2board/v2board/pull/981
https://www.vulncheck.com/advisories/v2board-xboard-authentication-token-exposure-via-loginwithmaillink

History

Jul 14, 2026 8:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:v2board:v2board::::::::

Apr 13, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 10, 2026 9:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cedar2025 Cedar2025 xboard V2board V2board v2board
Vendors & Products		Cedar2025 Cedar2025 xboard V2board V2board v2board

Apr 9, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.
Title		v2board / Xboard Authentication Token Exposure via loginWithMailLink
Weaknesses		CWE-201
References		https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/ https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Http/Controllers/V1/Passport/AuthController.php#L51 https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Services/Auth/MailLinkService.php#L49 https://github.com/cedar2025/Xboard/commit/121511523f04882ec0c7447acd9b8ebcb8a47957 https://github.com/cedar2025/Xboard/pull/873 https://github.com/v2board/v2board/blob/0ca47622a50116d0ddd7ffb316b157afb57d25e8/app/Http/Controllers/Passport/AuthController.php#L71 https://github.com/v2board/v2board/pull/981 https://www.vulncheck.com/advisories/v2board-xboard-authentication-token-exposure-via-loginwithmaillink
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 9.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`