# CVE-2026-39912: V2Board and Xboard authentication token exposure in loginWithMailLink

Source: https://junglewise.ai/threats/cve-2026-39912-v2board-and-xboard-authentication-token-exposure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-39912 · Severity: critical · CVSS 9.1 · Published 2026-04-09

V2Board and Xboard, popular management panels for VPN and proxy services, contain a critical flaw in their passwordless login feature. When a user requests a login link via email, the system accidentally includes the secret authentication token in the immediate web response. An attacker can use this to gain full access to any account, including administrator accounts, knowing only the user's email address. This allows for complete takeover of the service, exposure of customer payment history, and access to private VPN server configurations.

Technologies: [V2board](https://junglewise.ai/threats/technologies/v2board). Vendors: [V2board](https://junglewise.ai/threats/vendors/v2board).

## Quick answers

**Is CVE-2026-39912 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39912 being exploited in the wild.

**How severe is CVE-2026-39912?** Critical severity, with a CVSS score of 9.1, published 9 April 2026.

**Which products and versions are affected?** Cedar2025 Xboard through 0.1.9; V2board 1.6.1 through 1.7.4.

**Is there a fix for CVE-2026-39912?** A patch was published on 2026-04-09: Xboard fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39912 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-39912?** Check whether you run Cedar2025 Xboard or V2board at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in the 'loginWithMailLink' endpoint of V2Board and Xboard when the 'login_with_mail_link_enable' feature is active. The application incorrectly returns the generated magic login link (containing a sensitive 'verify' token) in the HTTP response body instead of only sending it via email. An unauthenticated attacker can trigger this by sending a POST request with a target email address, extract the token from the response, and exchange it at the 'token2Login' endpoint to obtain a valid bearer token. This results in full account takeover, including administrative privileges if the target email belongs to an admin. A patch is available for Xboard in version 0.2.0 (commit 1215115), while V2Board is reportedly abandoned and remains vulnerable.

## Affected products

- V2Board V2Board 1.6.1 through 1.7.4
- cedar2025 Xboard through 0.1.9

## Timeline

- 2022-06-27: other: Vulnerability introduced in V2Board 1.6.1
- 2026-04-08: disclosed: Public disclosure by security researcher Chocapikk
- 2026-04-09: advisory: CVE-2026-39912 published
- 2026-04-09: patched: Xboard fix committed to main branch

## References

- [https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/](https://chocapikk.com/posts/2026/xboard-v2board-account-takeover/)
- [https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Http/Controllers/V1/Passport/AuthController.php](https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Http/Controllers/V1/Passport/AuthController.php)
- [https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Services/Auth/MailLinkService.php](https://github.com/cedar2025/Xboard/blob/1fe6531924cc1ec662a88b9ef725afcf78d660bc/app/Services/Auth/MailLinkService.php)
- [https://github.com/cedar2025/Xboard/commit/121511523f04882ec0c7447acd9b8ebcb8a47957](https://github.com/cedar2025/Xboard/commit/121511523f04882ec0c7447acd9b8ebcb8a47957)
- [https://github.com/cedar2025/Xboard/pull/873](https://github.com/cedar2025/Xboard/pull/873)
- [https://github.com/v2board/v2board/blob/0ca47622a50116d0ddd7ffb316b157afb57d25e8/app/Http/Controllers/Passport/AuthController.php](https://github.com/v2board/v2board/blob/0ca47622a50116d0ddd7ffb316b157afb57d25e8/app/Http/Controllers/Passport/AuthController.php)
- [https://github.com/v2board/v2board/pull/981](https://github.com/v2board/v2board/pull/981)

## Related threats

- [V2Board SQL injection in Admin UserController](https://junglewise.ai/threats/cve-2026-37505-v2board-sql-injection-in-admin-usercontroller)
- [V2Board sensitive token exposure in UniProxyController](https://junglewise.ai/threats/cve-2026-37504-v2board-sensitive-token-exposure-in-uniproxycontroller)
- [V2Board stored XSS in theme configuration custom_html](https://junglewise.ai/threats/cve-2026-37503-v2board-stored-xss-in-theme-configuration-custom-html)