CVE-2026-39912: Php Magic Link Token Leak In Responsecve-2026-39912-php-magic-link-token-leak-in-response
Magic login link containing an authentication token is returned to the caller after being delivered by email. If the caller exposes this return value through an HTTP response, an unauthenticated attacker who knows a target email can retrieve the login token directly (CVE-2026-39912). Return only a boolean success indicator instead of the link.
