TI-2026-28784 Aliases CVE-2026-39912 GHSA-83h9-46h8-whf4

v2board / Xboard Authentication Token Exposure via loginWithMailLink

HIGH 80CWE-201Published 2026-04-09 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-201.

Summary

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00607 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
v2board	v2board	1.6.1 – 1.7.4	—	No fix listed	CNA
cedar2025	Xboard	up to 0.1.9	—	Patch available	CNA

v2board Vendorv2board Affected 1.6.1 – 1.7.4 Fixed in — No fix listed CNA
Xboard Vendorcedar2025 Affected up to 0.1.9 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-39912
2026-10-03 Alias added: GHSA-83h9-46h8-whf4
2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/

Patch 1

https://github.com/cedar2025/Xboard/commit/121511523f04882ec0c7447acd9b8ebcb8a47957

Other 5

TI-2026-28054 Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. CVSS 3.1HIGH 7.5
TI-2026-28053 Cross-Site Scripting (XSS) in V2Board thru 1.7.4. CVSS 3.1MEDIUM 6.9
TI-2026-28055 SQL Injection via ORDER BY clause in V2Board thru 1.7.4. CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences