What is the CVSS score of EUVD-2026-26668?

EUVD-2026-26668 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

V2Board EUVD-2026-26668

| CVE-2026-37504 MEDIUM

Use of GET Request Method With Sensitive Query Strings (CWE-598)

2026-05-01 mitre

PHP Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 16:00 vuln.today

EUVD ID Assigned

May 01, 2026 - 15:45 euvd

EUVD-2026-26668

Analysis Generated

May 01, 2026 - 15:45 vuln.today

CVE Published

May 01, 2026 - 00:00 nvd

MEDIUM 5.3

DescriptionCVE.org

Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy/user?token=SECRET, causing it to be recorded in web server access logs, browser history, HTTP Referer headers, and proxy/CDN logs. An attacker who gains access to any log source can extract the token and impersonate a proxy server node, potentially intercepting all user traffic.

AnalysisAI

V2Board through version 1.7.4 exposes sensitive server authentication tokens via GET parameters in the UniProxy API endpoint, causing tokens to be recorded in web server access logs, browser history, HTTP Referer headers, and intermediary proxies. An attacker who obtains access to any log source can extract the token and impersonate a proxy server node, potentially intercepting all user traffic passing through that node.

Technical ContextAI

V2Board is a subscription-based server panel written in PHP that manages proxy and VPN services. The vulnerability exists in app/Http/Controllers/Server/UniProxyController.php, where the server authentication token-a sensitive credential used for proxy node authentication-is transmitted as a GET parameter rather than in request headers or the request body. GET parameters are inherently logged by web servers, CDNs, proxy appliances, ISPs, and browsers by design. This violates fundamental HTTP security practices: sensitive credentials must never be transmitted via URL parameters due to their visibility in multiple logging contexts (server access logs, browser history, Referer headers, proxy logs). The root cause is improper credential transmission mechanism selection (CWE-598: Use of GET Request with Sensitive Query Strings).

RemediationAI

Upgrade V2Board to a patched version released after 1.7.4 that transmits server tokens via HTTP Authorization headers or request body (POST/JSON) instead of GET parameters. Patch availability information is not confirmed in the provided data; check the official V2Board repository (https://github.com/v2board/v2board) for the latest security release. Immediately after patching, rotate all server authentication tokens in production environments, as tokens transmitted via GET parameters in previous versions should be considered compromised. As an interim compensating control prior to patching, implement HTTP header filtering at the reverse proxy or WAF layer to block requests containing 'token=' in the query string, and restrict access to web server logs and CDN logs to authorized personnel only. Remove or redact existing log entries containing 'token=' parameters from accessible log archives. Note that WAF filtering does not prevent the token from being logged or transmitted-it only reduces exposure during the interim period.