The vulnerability in V2Board (up to version 1.7.4) involves the transmission of a sensitive server authentication token via a GET parameter in the UniProxyController.php file. Because the token is included in the URL, it is exposed in multiple logging mechanisms, increasing the risk of token leakage. An attacker who obtains the token from any log source can impersonate a proxy server node, which may allow interception of user traffic. The CVSS 3.1 vector indicates the attack requires high attack complexity, no privileges, no user interaction, and impacts confidentiality but not integrity or availability.

Exposure of the server authentication token through URLs leads to its presence in various logs and histories, creating multiple avenues for an attacker to obtain it. If an attacker gains access to these logs, they can impersonate a proxy server node, potentially intercepting all user traffic routed through that node. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid transmitting sensitive tokens via GET parameters. Consider using POST requests or other secure methods to transmit authentication tokens to prevent exposure in logs and histories.