CVE-2026-126544

MediumCVSS 4.3/10Last modified Nov 12, 2026

Description

WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1024

Affected software

Vendor	Product	Versions
WWBN	AVideo	>= 6.5, <= 29.7.1

References

Timeline

Published: Nov 11, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1265454.3WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registere CVE-2026-1265464.3Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing attackers to crash t CVE-2026-126558.8A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without v CVE-2026-1265594.8Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users w CVE-2026-126568.7A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network st CVE-2026-1265605.4Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises au CVE-2026-1265617.1Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right t CVE-2026-1265624.3Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter tha CVE-2026-1265636.1Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeForma CVE-2026-1265645.4Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject() that ren CVE-2026-1265654.3Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInter CVE-2026-1265667.1Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection()