CVE-2026-39912 json
v2board / Xboard Authentication Token Exposure via loginWithMailLink
published 2026-04-09 7 mo ago modified 2026-11-08 28 h ago also EUVD-2026-21043
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.
Patch / fix
- github.com/cedar2025/Xboard@1215115 commit
- github.com/v2board/v2board#981 pull request
- github.com/cedar2025/Xboard#873 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- chocapikk.com https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 9.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- v2board v2board
- cedar2025 Xboard
Classification
- Weakness
-
- CWE-201 Insertion of Sensitive Information Into Sent Data
References
-
github.com
/v2board/v2board/pull/981
issue-tracking, patch
-
github.com
/cedar2025/Xboard/pull/873
issue-tracking, patch
-
github.com
/cedar2025/Xboard/commit/121511523f04882ec0c7447acd9b8ebcb8a47957
patch
-
chocapikk.com
/posts/2026/xboard-v2board-account-takeover/
technical-description, exploit
-
github.com
/v2board/v2board/blob/0ca47622a50116d0ddd7ffb316b157afb57d25e8/app/Http/Controllers/Passport/AuthController.ph
related
-
github.com
/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Services/Auth/MailLinkService.php#L49
related
-
github.com
/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Http/Controllers/V1/Passport/AuthControlle
related
-
vulncheck.com
/advisories/v2board-xboard-authentication-token-exposure-via-loginwithmaillink
third-party-advisory
Sources
- CVE List CVE-2026-39912
- NVD CVE-2026-39912
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.