GHSA-f72w-prhp-h385: WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()

WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary usersid and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.