Is CVE-2026-92915 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92915 being exploited in the wild.

How severe is CVE-2026-92915?

High severity, with a CVSS score of 7.3, published 17 September 2026.

Which products and versions are affected?

WWBN AVideo through commit e01e41ecc (no patched version available).

Is there a fix for CVE-2026-92915?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92915 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92915?

Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92915: WWBN AVideo broken access control in email verification

CVE-2026-92915 · Severity: high · CVSS 7.3 · Published 2026-09-17

WWBN AVideo is a video hosting and streaming platform. An unauthenticated attacker can flood any user account with unlimited verification emails, enumerate which user accounts exist in the system, and generate password-reset tokens for arbitrary accounts—all without requiring authentication or any authorization checks. This enables account takeover, email harassment, and potential reputation damage to the platform operator.

Technologies: WWBN AVideo. Vendors: WWBN.

Quick answers

Is CVE-2026-92915 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92915 being exploited in the wild.
How severe is CVE-2026-92915?: High severity, with a CVSS score of 7.3, published 17 September 2026.
Which products and versions are affected?: WWBN AVideo through commit e01e41ecc (no patched version available).
Is there a fix for CVE-2026-92915?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92915 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92915?: Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control flaw in objects/userVerifyEmail.php. The script disables authentication ($global['ignoreUserMustBeLoggedIn'] = 1), accepts a users_id query parameter, and calls User::sendVerificationLink() without verifying the caller's identity, checking CSRF tokens, or enforcing rate limits. While a session-based throttle is intended, it is keyed to the caller's session and does not fire for cookie-less requests. Additionally, createVerificationCode() invokes $user->setRecoverPass() and persists the user object, writing a live password-recovery token to the targeted account. This token is encoded in base64 within the verification email and is accepted by objects/userRecoverPassSave.json.php as a credential for password reset. The endpoint also leaks account existence and verification status through three distinct JSON responses. An unauthenticated network attacker with no preconditions can abuse this endpoint to send unlimited emails, enumerate accounts, and mint password-reset tokens for any user.

Affected products

WWBN AVideo through commit e01e41ecc (no patched version available)

Timeline

2026-09-17: disclosed: CVE-2026-92915 and GHSA-rg4h-fcmm-8w26 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.