Executive brief
V2Board is a management panel for proxy protocol services. A security flaw allows sensitive authentication tokens to be transmitted in website addresses (URLs) rather than secure headers. This means the secret tokens are likely recorded in server logs, browser history, and by internet service providers, allowing anyone with access to those logs to hijack proxy nodes and potentially monitor user internet traffic.
Technical details
The vulnerability exists in app/Http/Controllers/Server/UniProxyController.php (also referred to as UniverseController.php in some documentation) where the 'server_token' is accepted via a GET query parameter. Because query strings are frequently logged by web servers (access logs), cached by intermediate proxies/CDNs, and stored in browser history or Referer headers, the token is exposed to any party with access to these infrastructure logs. An attacker who obtains a leaked token can impersonate a proxy server node, allowing them to intercept or manipulate user traffic passing through the panel. The project is reportedly unmaintained, and no official patch is available; users are advised to manually modify the code to accept tokens via request headers or POST bodies.
Affected products
- V2Board V2Board thru 1.7.4
Timeline
- 2026-04-30: disclosed: Vulnerability reported by Innora Security Research
- 2026-05-01: advisory: CVE published to NVD