CVE-2026-126544

MEDIUM 4.3

WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.

CWE	CWE-1024
Vendor	wwbn
Product	avideo
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for wwbn avideo

Be the first to know when new medium vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

WWBN / AVideo

6.5 ≤ 29.7.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-f72w-prhp-h385 github.com: https://github.com/WWBN/AVideo/commit/115116813611f2cbabfee3f5d9b49ce6f25ae959 github.com: https://github.com/WWBN/AVideo/blob/v29.7.1/objects/user.php#L3293-L3307 vulncheck.com: https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-email-verification-bypass-via-user-verifycode

Credits

AlpetGexha