EUVD-2026-21043
GHSA-83h9-46h8-whf4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPOST to loginWithMailLink endpoint with known email
-
ExploitReceive authentication token in HTTP response
-
ExecutionExchange token at token2Login endpoint
-
ImpactObtain valid bearer token with admin privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | V2Board 1.6.1–1.7.4 or Xboard through 0.1.9 with login_with_mail_link_enable feature active. Unauthenticated remote attacker POSTs known email to loginWithMailLink endpoint, receives authentication token in response, exchanges token at token2Login endpoint for bearer token granting admin access. |
| Impact | Critical unauthenticated account takeover affecting V2Board and Xboard. Attackers POST known email addresses to loginWithMailLink, receive auth tokens in response, then exchange them for bearer tokens granting full account access including admin privileges. Network-accessible endpoint with low complexity and no user interaction required. Patch available; unpatched instances face immediate compromise risk. |
| Exploit ScenarioDerived | Attacker POST-requests loginWithMailLink endpoint with target email address, receives authentication token in HTTP response. Token exchanged at token2Login endpoint to obtain valid bearer token, enabling full account access and privilege escalation. Publicly available exploit code exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Authentication bypass in V2Board 1.6.1-1.7.4 and Xboard ≤0.1.9 enables unauthenticated account takeover including admin privileges. When login_with_mail_link_enable is active, attackers POST known email addresses to the loginWithMailLink endpoint, receiving full authentication URLs in HTTP responses. Tokens extracted from these URLs are exchanged at token2Login for valid bearer tokens granting complete account access. Publicly available exploit code exists. CVSS 9.1 critical severity reflects network-accessible attack with no user interaction required.
RemediationAI
Vendor-released patches: Upgrade V2Board to version addressing GitHub PR #981 or apply commit fixes from upstream repository. Upgrade Xboard to commit 121511523f04882ec0c7447acd9b8ebcb8a47957 or later patched release incorporating PR #873. If immediate upgrade is impossible, disable login_with_mail_link_enable feature in application configuration to eliminate the attack vector. Rotate all existing authentication tokens and audit access logs for unauthorized sessions created via loginWithMailLink or token2Login endpoints. Review VulnCheck advisory for additional mitigation guidance: https://www.vulncheck.com/advisories/v2board-xboard-authentication-token-exposure-via-loginwithmaillink. Validate patch deployment by confirming tokens no longer appear in loginWithMailLink HTTP responses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-201 information exposure via authentication token leakage in response bodies. AuthController.php and MailLinkService.php return sensitive tokens directly in loginWithMailLink responses instead of transmitting via secure email channels. PR:N confirms unauthenticated exploitation; attackers enumerate valid emails and extract tokens from JSON responses without SMTP interception.
Know when V2Board gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.
Articles & Coverage 1
Executive ViewAI
V2Board and Xboard installations are vulnerable to unauthenticated account takeover affecting all user accounts including administrators through a compromised email-based authentication mechanism. Organizations using affected versions (V2Board 1.6.1-1.7.4 or Xboard ≤0.1.9) face immediate risk of unauthorized administrative access, data theft, and service disruption because attackers can gain full system control without credentials.
If patch cannot be applied within 24 hours: immediately disable login_with_mail_link_enable configuration setting; restrict network access to loginWithMailLink and token2Login endpoints to trusted IP ranges; monitor authentication logs for POST requests to loginWithMailLink endpoint and revoke any suspicious bearer tokens. Apply vendor patch as soon as operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB