CVE-2026-39912Critical· 9.1▾ AbyssalPoC availableV2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.6%
1 GitHub repo (last check)
V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.
v2board >= 1.6.1 <= 1.7.4v2board >= bdb10bed32c5f37df2f0872c3cb354e9b7a293bd <= 0ca47622a50116d0ddd7ffb316b157afb57d25e8Xboard <= 0.1.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107268Medium· 4.3Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207
CVE-2023-3399High· 8.5Insertion of Sensitive Information Into Sent Data in GitLab
CVE-2026-116190Low· 3.7rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect
CVE-2026-86414Critical· 9.1leaking host credentials to HTTP proxy
CVE-2026-86409High· 8.1stale SigV4 headers sent unintended
CVE-2026-86413Critical· 9.1Negotiate credentials sent to redirected origin