CVE Intelligence
Analysis AI-assisted

CVE-2026-39912: V2Board and Xboard authentication token exposure in loginWithMailLink

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 return authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. The record indicates that an unauthenticated party who knows an email address could obtain a token that leads to full account access, including administrative privileges. No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed version ranges.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

V2Board and Xboard are panel applications that include a mail-link login feature. According to the record, when login_with_mail_link_enable is active, the loginWithMailLink endpoint places a full authentication URL, including its token, in the HTTP response body. The weakness is classified as CWE-201, Insertion of Sensitive Information Into Sent Data. Sources: NVD and VulnCheck advisory.

Impact

  • The record states that an unauthenticated party can obtain an authentication token, leading to full account access, including administrative privileges.
  • The CVSS 3.1 base score is 9.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating high confidentiality and integrity impact over the network without privileges.
  • A CVSS 4.0 score of 9.1 is also listed by the CNA.

Affected products and versions

  • V2Board from 1.6.1 through 1.7.4, as stated in the record.
  • Xboard through 0.1.9, as stated in the record.
  • The record's affected list is empty, so official version ranges could not be confirmed from the structured data. Operators should verify their installed version against the vendor and project sources linked below.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so no active exploitation is confirmed by KEV.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00699 with a percentile of 0.51886, as recorded.

Remediation and mitigation

  • Check whether the mail-link login feature is enabled and disable login_with_mail_link_enable if it is not required.
  • Review the Xboard commit and pull request linked in the references, and apply upstream changes from the project. The record does not state which version contains the fix.
  • Rotate sessions and tokens for accounts that may have used mail-link login, especially administrator accounts, after applying changes.
  • Restrict access to the panel administrative interface where possible.

Detection guidance

  • Review web server and application logs for requests to the loginWithMailLink endpoint, particularly from unexpected sources or in unusual volumes.
  • Monitor for administrative actions performed from unfamiliar sessions or IP addresses.
  • Audit recent logins to administrator accounts and compare them with known user activity.

Limitations of the available information

  • The record contains no structured affected or fixed version data.
  • The record does not confirm which version first includes a fix.
  • The source status is Deferred, and the record was assembled from the references listed, which may change as the advisory is updated.

Frequently asked questions

What does CVE-2026-39912 affect?

According to the record, V2Board from 1.6.1 through 1.7.4 and Xboard through 0.1.9 are affected when the login_with_mail_link_enable feature is active. The structured affected list in the record is empty, so confirm your version against the project sources.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in this record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.