tom/dpl
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
6796b70179
dpl/app/Services/Auth
History
Valentin Lobstein cf5cece77f Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink (#873) 
The loginWithMailLink endpoint returns the magic login link in the
HTTP response body, allowing unauthenticated account takeover.

The fix returns true instead of the link. The email delivery is
the authentication factor.

Bug inherited from V2Board commit 9b707aaf (2022-06-27).
2026-04-10 02:44:20 +08:00
..
LoginService.php feat: implement email case-insensitive queries (fix #318) 2026-03-28 07:09:21 +08:00
MailLinkService.php Fix: CVE-2026-39912 - Magic link token leak in loginWithMailLink (#873) 2026-04-10 02:44:20 +08:00
RegisterService.php feat: implement email case-insensitive queries (fix #318) 2026-03-28 07:09:21 +08:00