WWBN AVideo: Email verification bypass in User::verifyCode()
Summary
AVideo versions 6.5 through 29.7.1 contain an email verification bypass in User::verifyCode(). Due to a PHP loose comparison of the recoverPass token, a registered user can craft a verification code with an arbitrary users_id and recoverPass set to true, using the installation-wide salt from their own verification link. This allows the attacker to verify the email addresses of other accounts and unlock features such as live streaming.
Affected
- WWBN AVideo 6.5 through 29.7.1
- Vulnerable component: User::verifyCode() in objects/user.php
Fixed in
- Unknown. The first fixed release could not be confirmed; check the vendor advisory GHSA-f72w-prhp-h385 for the fixed version.
- Patch commit: 115116813611f2cbabfee3f5d9b49ce6f25ae959
Workaround
- Unknown. No vendor or third-party workaround has been published.
- Restrict open user registration until a fixed version is installed.
Exploitation
- Not listed in CISA KEV.
- No public proof of concept detected.
- Not known to be exploited in the wild.
Our recommendation
- Confirm whether AVideo is deployed and which version runs.
- If the version is in the affected range, check the GHSA advisory for the fixed release and upgrade.
- Restrict open registration until patched.
- Review recently verified accounts, especially those with access to live streaming.
- Prioritise the related AVideo CVEs in the same batch (CVE-2026-126542, CVE-2026-126541) and patch them together.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub advisory GHSA-f72w-prhp-h385 github.com
- GitHub commit 115116813611f2cbabfee3f5d9b49ce6f25ae959 github.com
- GitHub user.php at v29.7.1 github.com
- VulnCheck advisory www.vulncheck.com
- CVE Record CVE-2026-126544 www.cve.org
- TheHackerWire CVE-2026-126544 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:13.
Original description (NVD)
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.
NVD references (4)
- https://github.com/WWBN/AVideo/blob/v29.7.1/objects/user.php#L3293-L3307
- https://github.com/WWBN/AVideo/commit/115116813611f2cbabfee3f5d9b49ce6f25ae959
- https://github.com/WWBN/AVideo/security/advisories/GHSA-f72w-prhp-h385
- https://www.vulncheck.com/advisories/wwbn-avideo-6.5-through-29.7.1-email-verification-bypass-via-user-verify…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.