Is CVE-2026-84480 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84480 being exploited in the wild.

How severe is CVE-2026-84480?

Critical severity, with a CVSS score of 9.8, published 1 September 2026.

Is there a fix for CVE-2026-84480?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84480 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84480?

Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84480: WWBN AVideo password recovery token expiration bypass

CVE-2026-84480 · Severity: critical · CVSS 9.8 · Published 2026-09-01

WWBN AVideo is a popular video hosting and streaming platform. An attacker who obtains a password recovery token—even if it has expired—can use it indefinitely to reset any user account's password and gain full account access. This vulnerability eliminates the time-based protection that should prevent reuse of old tokens, turning a potentially intercepted email into a permanent account takeover tool.

Technologies: WWBN AVideo. Vendors: WWBN.

Quick answers

Is CVE-2026-84480 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84480 being exploited in the wild.
How severe is CVE-2026-84480?: Critical severity, with a CVSS score of 9.8, published 1 September 2026.
Which products and versions are affected?: WWBN AVideo 29.0 and earlier.
Is there a fix for CVE-2026-84480?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84480 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84480?: Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insufficient session expiration (CWE-613) in the userRecoverPassSave.json.php endpoint. The password recovery workflow generates time-limited tokens (24-hour validity window) stored encrypted in the database, with a checkRecoverPass() method that properly validates expiration. However, the password-reset endpoint bypasses this validation and performs only a direct string comparison of the token, never decrypting or checking the embedded expiration timestamp. Additionally, a second logic error in the isRecoverPassValid() function uses a less-than comparison instead of equality when checking token ownership, allowing tokens issued for higher user IDs to be misused against lower-numbered accounts. An attacker with a leaked or intercepted recovery token can use it at any time—with no rate limiting—to change the target account's password and achieve full account compromise.

Affected products

WWBN AVideo 29.0 and earlier

Timeline

2026-08-18: disclosed: GitHub Security Advisory GHSA-j9p7-hm85-9v77 published
2026-09-01: advisory: CVE-2026-84480 and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.