Critical severity9.8NVD Advisory· Published Sep 1, 2026

CVE-2026-84480

Description

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.

Affected products

WWBN/Avideollm-fuzzy

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-j9p7-hm85-9v77nvd
www.vulncheck.com/advisories/wwbn-avideo-password-recovery-token-expiration-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000