lkddi/Xboard
1
0
Fork 0
mirror of https://github.com/lkddi/Xboard.git synced 2026-04-14 19:40:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink (#873)

Browse Source 
The loginWithMailLink endpoint returns the magic login link in the
HTTP response body, allowing unauthenticated account takeover.

The fix returns true instead of the link. The email delivery is
the authentication factor.

Bug inherited from V2Board commit bdb10bed (2022-06-27).
This commit is contained in:
Valentin Lobstein
2026-04-09 20:44:20 +02:00
committed by GitHub
parent 1fe6531924
commit 121511523f
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Services/Auth/MailLinkService.php
View File

@@ -46,7 +46,7 @@ class MailLinkService
$this->sendMailLinkEmail($user, $link);
return [true, $link];
return [true, true];
}
/**