Executive brief
WWBN AVideo is a popular video hosting and streaming platform. An attacker who obtains a password recovery token—even if it has expired—can use it indefinitely to reset any user account's password and gain full account access. This vulnerability eliminates the time-based protection that should prevent reuse of old tokens, turning a potentially intercepted email into a permanent account takeover tool.
Technical details
The vulnerability is an insufficient session expiration (CWE-613) in the userRecoverPassSave.json.php endpoint. The password recovery workflow generates time-limited tokens (24-hour validity window) stored encrypted in the database, with a checkRecoverPass() method that properly validates expiration. However, the password-reset endpoint bypasses this validation and performs only a direct string comparison of the token, never decrypting or checking the embedded expiration timestamp. Additionally, a second logic error in the isRecoverPassValid() function uses a less-than comparison instead of equality when checking token ownership, allowing tokens issued for higher user IDs to be misused against lower-numbered accounts. An attacker with a leaked or intercepted recovery token can use it at any time—with no rate limiting—to change the target account's password and achieve full account compromise.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-18: disclosed: GitHub Security Advisory GHSA-j9p7-hm85-9v77 published
- 2026-09-01: advisory: CVE-2026-84480 and NVD entry published