CVE-2026-84480 Details
Description
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
A vulnerability in WWBN AVideo in versions through 29.0 allows for password recovery tokens to be used indefinitely, as the application fails to properly validate the expiration of these tokens. This flaw is located in the 'userRecoverPassSave.json.php' file, where expired tokens can still be used to reset passwords, leading to unauthorized access to user accounts. The issue arises because the password recovery process does not incorporate a time-based validity check, allowing attackers to exploit old tokens to gain full access to accounts.
Users are advised to update to the latest version of WWBN AVideo, as this vulnerability has been addressed in the patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 1, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-j9p7-hm85-9v77 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/wwbn-avideo-password-recovery-token-expiration-bypass | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 29.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 1, 2026 | New CVE Received | [email protected] |