Description
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | ≤ 29.0 | — |
References
- GitHub Security Advisory (GHSA-j9p7-hm85-9v77) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Password Recovery Token Expiration Bypass third-party-advisory