CVE-2026-39912

CVE-2026-39912 - Xboard / V2Board 未認証アカウント乗っ取り loginWithMailLink におけるマジックリンクトークンの漏洩 | ---|--- CVE| CVE-2026-39912 CVSS| 9.1 重大 CWE| CWE-201 送信データへの機密情報の挿入 影響を受けるバージョン| V2Board = 1.6.1 から 1.7.4 まで / Xboard 0.1.9+ までの全バージョン 修正状況| 未修正 V2Board は2023年6月以降開発停止 公開日| 2026-04-09 発見者| Valentin Lobstein...

CVE-2026-39912

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the loginwithmaillinkenable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receiv...

EUVD-2026-21043

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the loginwithmaillinkenable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receiv...

CVE-2026-39912 v2board / Xboard Authentication Token Exposure via loginWithMailLink

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the loginwithmaillinkenable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receiv...

V2Board 安全漏洞

V2Board is an open-source multi-user agent service management panel developed by V2Board. Versions 1.6.1 to 1.7.4 of V2Board, as well as Xboard 0.1.9 and earlier versions, have security vulnerabilities. These vulnerabilities stem from the HTTP response body of the loginWithMailLink endpoint...

CVE-2026-39912: Insertion of Sensitive Information Into Sent Data

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the loginwithmaillinkenable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receiv...