Chocapikk/CVE-2026-39912

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-39912 by sending a POST request to the loginWithMailLink endpoint to leak a magic link token, then exchanging it at the token2Login endpoint to obtain a bearer token and dump user data.

Backdoor review

No backdoor observed in reviewed code

The PoC exploit.py performs exactly the documented CVE-2026-39912 account takeover: it requests a magic link, extracts the leaked token, exchanges it for a bearer token, and dumps user data. No concealed, deceptive, or unrelated harmful behavior is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareV2BoardXboard
Attack typesauthentication bypassinformation disclosureaccount takeover
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script (exploit.py) that actively exploits the vulnerability by sending HTTP requests to leak a token, exchange it for a bearer token, and access protected resources. The README describes it as an 'Account takeover + data dump' and provides usage examples showing exploitation.

exploit.py:1-136README.md:39-44

Requirements

  • login_with_mail_link_enable must be enabled in admin settingsREADME.md:30exploit.py:17
  • A valid registered email addressREADME.md:31exploit.py:18

Observed behavior

  • Sends an unauthenticated POST request to /api/v1/passport/auth/loginWithMailLink with a JSON body containing the target emailexploit.py:74-77
  • Extracts the magic link token from the HTTP response bodyexploit.py:82-83
  • Exchanges the leaked verify token at /api/v1/passport/auth/token2Login to obtain a bearer tokenexploit.py:89-92
  • Uses the obtained bearer token to authenticate and dump user data from multiple API endpointsexploit.py:43-56exploit.py:101-110
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Account takeover via magic link token leakThe script implements the described CVE-2026-39912 vulnerability: POST to loginWithMailLink, extract token from response, exchange at token2Login, then enumerate user endpoints.exploit.py:72-99exploit.py:101-110
Network Target
User-supplied target URL and emailThe script takes a target URL and email as command-line arguments; no hardcoded exfiltration endpoint or unrelated network activity is present.exploit.py:114-118
Output Behavior
Dumps authentication token and user data to stdout or a local fileThe script prints or saves the obtained auth token and enumerated user data; no evidence of exfiltration to a remote server.exploit.py:125-132
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md and exploit.py) were reviewed; no binary or other files exist in the artifact.
  • The review does not assess the safety of running the PoC against unauthorized targets or the legality of its use.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1