V2Board versions through 1.7.4 expose a sensitive server authentication token via a GET parameter in the UniProxyController. This token appears in URLs and can be logged in various places such as web server logs, browser history, and proxy/CDN logs. An attacker with access to these logs could extract the token and impersonate a proxy server node, potentially intercepting user traffic.