CVE-2026-126544: WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary usersid and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs to be a registered user and obtain the installation-wide salt from their own email-verification link. No interaction from the targeted account is required.
What is the practical impact of a successful exploit?
A registered attacker can verify another user's email address by crafting a verification request with the target user's ID and recoverPass set to true. This can unlock email-verification-gated features, including live streaming.
Are all affected installations exposed by default?
The described attack depends on the application issuing email-verification links to registered users and on features being gated by email verification. Any registered user who can receive their own verification link may be able to derive the installation-wide salt needed for the attack.
How can I determine whether my deployment is affected?
Deployments running WWBN AVideo versions 6.5 through 29.7.1 are affected according to the advisory. Review objects/user.php, specifically User::verifyCode(), for recoverPass token validation using PHP loose comparison.
What can be done if an update cannot be applied immediately?
Restrict registration and prevent untrusted users from creating accounts or receiving verification links where possible. Also limit or disable features that are unlocked solely by email verification, such as live streaming, until the vulnerable verification logic is corrected.