Password Recovery Token Expiration Bypass in WWBN AVideo

CVE-2026-84480

What is CVE-2026-84480?

The vulnerability in WWBN AVideo allows attackers to exploit a flaw in the password recovery functionality. Specifically, the application does not properly validate the expiration of password recovery tokens in the userRecoverPassSave.json.php file. This oversight enables unauthorized users to utilize expired recovery tokens to reset account passwords indefinitely, leading to potential account takeovers. Attackers only need access to a valid recovery token, which they can use at any point to change the associated account's password, resulting in full access to the user's account.

References