CVE-2026-84480

WWBN AVideo, an open-source self-hosted video platform, does not validate whether password recovery tokens have expired when they are submitted to userRecoverPassSave.json.php. An attacker who obtains a user's recovery token, for example from a leaked or intercepted reset email, can submit it at any later time to reset that account's password and gain full access to the account. Any AVideo deployment that issues password recovery tokens is affected, and the disclosure does not specify which versions are impacted or which release contains a fix. Exploitation has not been observed: there is no known public proof-of-concept, EPSS assigns a 0.3% probability of exploitation in the next 30 days, and the flaw is not in CISA KEV. Defenders should treat any account whose reset token was ever emailed or exposed as at risk until a vendor patch is available and applied.

What to do: Review your AVideo deployment for outstanding password-reset emails and consider invalidating existing recovery tokens (e.g., clearing stored recovery-pass values) or forcing password changes on accounts whose reset links may have been exposed. Restrict or monitor access to userRecoverPassSave.json.php until a vendor fix is published, and check accounts for unexpected password changes; the disclosure does not name a patched version, so watch the WWBN/AVideo project for an update.