CVE-2026-126544
4.3 MEDIUMpublic exploit availablePublished 2026-11-11 · Updated 2026-11-11
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1024
Public exploit & PoC references
All references
- https://github.com/WWBN/AVideo/blob/v29.7.1/objects/user.php#L3293-L3307
- https://github.com/WWBN/AVideo/commit/115116813611f2cbabfee3f5d9b49ce6f25ae959
- https://github.com/WWBN/AVideo/security/advisories/GHSA-f72w-prhp-h385
- https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-email-verification-bypass-via-user-verifycode
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
Related by shared AI tags and CWE weakness class. Browse the full archive.