V2Board/Xboard Unauthorized Account Takeover via Magic Link Token Leakage

Vulnerability Overview The Xboard and V2Board panels contain an unauthorized account takeover vulnerability caused by the "Magic Link Login" feature. When an administrator enables this feature, an attacker can simply send a request containing the target email address to the API interface. While the server sends the email, it simultaneously returns the login link containing the verification token (Token) directly in the HTTP response body. Attackers do not need to access the target email; they can directly utilize the returned link to obtain administrator privileges, achieving zero-credential account takeover. Scope of Impact V2Board: Versions 1.6.1 (June 2022) to 1.7.4 (End of Life). Xboard: All versions v0.1.9 and above. Default Configuration Risk: The official documentation's recommended installation commands default to as the administrator email. Combined with this vulnerability, this allows direct account takeover. RCE Risk: The file in Xboard contains a hardcoded . This results in predictable keys generated during Docker installation, allowing attackers to bypass security path restrictions to achieve Remote Code Execution (RCE) by uploading theme files containing PHP code. Remediation Modify the logic in and : After sending the email, do not return the variable to the client. Instead, return only (indicating successful operation), consistent with the response returned when processing non-existent email addresses. Proof of Concept (POC) 1. Request Magic Link (Obtain Token) Response Example: 2. Exchange Token (Obtain Session) Response Example: 3. API Endpoints Available After Gaining Administrator Privileges - Email, UUID, Balance, Subscription Details - VPN Subscription Token, Subscription URL - Server List and Connection Details - Payment History - Support Tickets - All Active Sessions - Invitation Codes Vulnerable Code Snippets V2Board : Xboard :**

Goal Reached Thanks to every supporter — we hit 100%!

V2Board/Xboard Unauthorized Account Takeover via Magic Link Token Leakage