V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.
When the mail link login feature is enabled, the loginWithMailLink endpoint returns the full authentication URL in the HTTP response instead of sending it only to the user's email address. An attacker, knowing only the victim's email address, sends a POST request to the loginWithMailLink endpoint and receives the token directly in the server response (CWE-201: exposure of sensitive information in transmitted data). The attacker then passes the obtained token to the token2Login endpoint, receiving a valid bearer token that provides full account access, including administrative privileges.
An unauthenticated attacker can take full control of any user or administrator account without knowing the password, resulting in complete breach of account confidentiality and integrity.
A patch available in the Xboard repository should be applied (commit 121511523f04882ec0c7447acd9b8ebcb8a47957, pull request #873). Until the update is applied, it is recommended to disable the login_with_mail_link_enable function in the application configuration.
V2Board versions 1.6.1 to 1.7.4 and Xboard versions up to 0.1.9 inclusive, when the login_with_mail_link_enable feature is active.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X