Email Verification Bypass in WWBN AVideo Products
CVE-2026-126544

5.3MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126544?

WWBN AVideo versions 6.5 through 29.7.1 are exposed to an email verification bypass vulnerability in the User::verifyCode() method. The vulnerability arises from improper PHP loose comparison of the recoverPass token, allowing unauthorized users to manipulate the verification process. By crafting a verification code with an installation-wide salt and arbitrary user IDs, attackers can potentially verify and access features reserved for other user accounts, including live streaming. This flaw poses significant risks to user account integrity and the overall security of the application.

Affected Version(s)

AVideo 6.5 <= 29.7.1

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-f...
vendor-advisory
https://github.com/WWBN/AVideo/commit/115116813611f2cbabf...
patch
https://github.com/WWBN/AVideo/blob/v29.7.1/objects/user....
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AlpetGexha
.