Description
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | 6.5 – ≤ 29.7.1 | — |
References
- GitHub Security Advisory (GHSA-f72w-prhp-h385) vendor-advisory
- https://github.com/WWBN/AVideo/commit/115116813611f2cbabfee3f5d9b49ce6f25ae959 patch
- https://github.com/WWBN/AVideo/blob/v29.7.1/objects/user.php#L3293-L3307 technical-description
- VulnCheck Advisory: WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode() third-party-advisory