Broken Access Control Vulnerability in WWBN AVideo

CVE-2026-92915

What is CVE-2026-92915?

The WWBN AVideo platform is vulnerable to a broken access control issue found in objects/userVerifyEmail.php. This flaw permits unauthenticated attackers to initiate arbitrary verification email requests by manipulating user ID parameters directly from the query string without any session validation or throttling controls. As a result, unauthorized users can generate an unlimited number of verification emails for any account, leading to account enumeration and unauthorized access. Furthermore, the vulnerability exposes sensitive functionality where an attacker can manipulate password recovery tokens, posing significant risks to user accounts.

References