Executive brief
WWBN AVideo is a video hosting and streaming platform. An unauthenticated attacker can flood any user account with unlimited verification emails, enumerate which user accounts exist in the system, and generate password-reset tokens for arbitrary accounts—all without requiring authentication or any authorization checks. This enables account takeover, email harassment, and potential reputation damage to the platform operator.
Technical details
The vulnerability is a broken access control flaw in objects/userVerifyEmail.php. The script disables authentication ($global['ignoreUserMustBeLoggedIn'] = 1), accepts a users_id query parameter, and calls User::sendVerificationLink() without verifying the caller's identity, checking CSRF tokens, or enforcing rate limits. While a session-based throttle is intended, it is keyed to the caller's session and does not fire for cookie-less requests. Additionally, createVerificationCode() invokes $user->setRecoverPass() and persists the user object, writing a live password-recovery token to the targeted account. This token is encoded in base64 within the verification email and is accepted by objects/userRecoverPassSave.json.php as a credential for password reset. The endpoint also leaks account existence and verification status through three distinct JSON responses. An unauthenticated network attacker with no preconditions can abuse this endpoint to send unlimited emails, enumerate accounts, and mint password-reset tokens for any user.
Affected products
- WWBN AVideo through commit e01e41ecc (no patched version available)
Timeline
- 2026-09-17: disclosed: CVE-2026-92915 and GHSA-rg4h-fcmm-8w26 published