Is CVE-2026-37504 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37504 being exploited in the wild.

How severe is CVE-2026-37504?

Medium severity, with a CVSS score of 5.3, published 1 May 2026.

Is there a fix for CVE-2026-37504?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37504 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-37504?

Check whether you run V2board. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37504: V2Board sensitive token exposure in UniProxyController

CVE-2026-37504 · Severity: medium · CVSS 5.3 · Published 2026-05-01

V2Board is a management panel for proxy protocol services. A security flaw allows sensitive authentication tokens to be transmitted in website addresses (URLs) rather than secure headers. This means the secret tokens are likely recorded in server logs, browser history, and by internet service providers, allowing anyone with access to those logs to hijack proxy nodes and potentially monitor user internet traffic.

Technologies: V2board. Vendors: V2board.

Quick answers

Is CVE-2026-37504 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37504 being exploited in the wild.
How severe is CVE-2026-37504?: Medium severity, with a CVSS score of 5.3, published 1 May 2026.
Which products and versions are affected?: V2Board V2Board thru 1.7.4.
Is there a fix for CVE-2026-37504?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37504 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-37504?: Check whether you run V2board. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in app/Http/Controllers/Server/UniProxyController.php (also referred to as UniverseController.php in some documentation) where the 'server_token' is accepted via a GET query parameter. Because query strings are frequently logged by web servers (access logs), cached by intermediate proxies/CDNs, and stored in browser history or Referer headers, the token is exposed to any party with access to these infrastructure logs. An attacker who obtains a leaked token can impersonate a proxy server node, allowing them to intercept or manipulate user traffic passing through the panel. The project is reportedly unmaintained, and no official patch is available; users are advised to manually modify the code to accept tokens via request headers or POST bodies.

Affected products

V2Board V2Board thru 1.7.4

Timeline

2026-04-30: disclosed: Vulnerability reported by Innora Security Research
2026-05-01: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.