Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink (#873)

The loginWithMailLink endpoint returns the magic login link in the HTTP response body, allowing unauthenticated account takeover. The fix returns true instead of the link. The email delivery is the authentication factor. Bug inherited from V2Board commit 9b707aaf (2022-06-27).
2026-04-09 20:44:20 +02:00 · 2026-04-09 20:44:20 +02:00 · cf5cece77f
commit cf5cece77f
parent 9c03a344f9
1 changed files with 1 additions and 1 deletions
--- a/app/Services/Auth/MailLinkService.php
+++ b/app/Services/Auth/MailLinkService.php
@ -46,7 +46,7 @@ class MailLinkService

        $this->sendMailLinkEmail($user, $link);

-        return [true, $link];
+        return [true, true];
    }

    /**