PT-2026-31695 · Xboard+1 · Xboard+1

Valentin Lobstein · Published 2026-04-09 · Updated 2026-04-12 · CVE-2026-39912

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions V2Board versions 1.6.1 through 1.7.4 and Xboard versions through 0.1.9

Description V2Board and Xboard are affected by an issue where authentication tokens are exposed in the HTTP response bodies of the loginWithMailLink endpoint when the login with mail link enable feature is active. An unauthenticated attacker can send a POST request to the loginWithMailLink endpoint with a known email address and receive a full authentication URL in the response. This URL can then be used to exchange the token at the token2Login endpoint, granting the attacker a valid bearer token with full account access, including administrative privileges.

Recommendations For V2Board versions 1.6.1 through 1.7.4, disable the login with mail link enable feature. For Xboard versions through 0.1.9, disable the login with mail link enable feature.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-39912

Affected Products

V2Board

Xboard

References · 16

• 🔥 https://chocapikk.com/posts/2026/xboard-v2board-account-takeover · Exploit
• https://github.com/cedar2025/Xboard/commit/121511523f04882ec0c7447acd9b8ebcb8a47957 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39912 · Security Note
• https://github.com/v2board/v2board/pull/981 · Note
• https://github.com/v2board/v2board/blob/0ca47622a50116d0ddd7ffb316b157afb57d25e8/app/Http/Controllers/Passport/AuthController.php#L71 · Note
• https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Http/Controllers/V1/Passport/AuthController.php#L51 · Note
• https://github.com/cedar2025/Xboard/pull/873 · Note
• https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Services/Auth/MailLinkService.php#L49 · Note
• https://twitter.com/OrizonCyber/status/2042324182952759724 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042340911170904399 · Twitter Post
• https://vulncheck.com/advisories/v2board-xboard-authentication-token-exposure-via-loginwithmaillink · Note
• https://twitter.com/CveFindCom/status/2042327419768435037 · Twitter Post
• https://twitter.com/CVEnew/status/2042340090135929055 · Twitter Post
• https://twitter.com/Chocapikk_/status/2042317387249164623 · Twitter Post
• https://twitter.com/0dayPublishing/status/2042319030829166899 · Twitter Post