Critical 9.1Published Apr 9, 2026

CVE-2026-39912v2board / Xboard Authentication Token Exposure via loginWithMailLink

Updated under an hour ago (Oct 28, 2026, 1:00 PM ET)

Does this affect you?

It affects v2board and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for v2board

Exploited in the last 30 days

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.

CVSS: 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-201
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

v2board v2board v2board:v2board (from the name)	from 1.6.1 through 1.7.4; from bdb10bed32c5f37df2f0872c3cb354e9b7a293bd through 0ca47622a50116d0ddd7ffb316b157afb57d25e8	CNA record
cedar2025 Xboard cedar2025:xboard (from the name)	through 0.1.9; 121511523f04882ec0c7447acd9b8ebcb8a47957 not affected	CNA record

References

References

https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/	technical-description, exploit
https://github.com/v2board/v2board/pull/981	issue-tracking
https://github.com/cedar2025/Xboard/pull/873	issue-tracking
https://github.com/v2board/v2board/blob/0ca47622a50116d0ddd7ffb316b157afb57d25e8/app/Http/Controllers/Passport/AuthController.php#L71	related
https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Services/Auth/MailLinkService.php#L49	related
https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Http/Controllers/V1/Passport/AuthController.php#L51	related
https://github.com/cedar2025/Xboard/commit/121511523f04882ec0c7447acd9b8ebcb8a47957	patch
https://www.vulncheck.com/advisories/v2board-xboard-authentication-token-exposure-via-loginwithmaillink	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.