CVE-2026-84480: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-84480 Overview

CVE-2026-84480 is a broken authentication vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw resides in userRecoverPassSave.json.php, which fails to validate the expiration timestamp on password recovery tokens. Attackers who obtain a recovery token can reuse it indefinitely to reset the target account's password and take full control of the account. The issue is tracked under CWE-613: Insufficient Session Expiration and can be triggered remotely without authentication or user interaction.

Critical Impact

Any expired or previously issued password recovery token can be replayed to hijack the associated account, resulting in full account takeover including administrative accounts.

Affected Products

• WWBN AVideo streaming platform
• userRecoverPassSave.json.php password recovery endpoint
• Deployments relying on the built-in account recovery workflow

Discovery Timeline

• 2026-09-01 - CVE-2026-84480 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84480

Vulnerability Analysis

The vulnerability exists in the password recovery flow implemented in userRecoverPassSave.json.php. AVideo issues a recovery token when a user requests a password reset. The server-side handler that processes the subsequent password change verifies that the token matches a stored value but does not verify the token's expiration timestamp. As a result, a token remains valid until it is rotated or the underlying account state changes.

An attacker who obtains a recovery token, whether through log exposure, referrer leakage, email compromise, or interception, can submit it to the recovery endpoint at any point in the future. The server accepts the token and applies the attacker-supplied password to the target account.

The attack requires network access to the AVideo instance and no prior authentication. Because the tokens grant password reset authority, successful exploitation leads to complete compromise of confidentiality, integrity, and availability of the targeted account.

Root Cause

The root cause is missing session expiration enforcement [CWE-613]. The recovery handler compares the supplied token against the stored token but omits a check against the token's issuance or expiry timestamp. Tokens that should have expired remain honored by the server.

Attack Vector

Exploitation is performed remotely over the network. An attacker sends a crafted HTTP POST request to userRecoverPassSave.json.php containing a valid or previously issued recovery token, the target user identifier, and a new password. The server updates the account password without validating token age, granting the attacker authenticated access on the next login.

No verified public exploit code has been released. See the GitHub Security Advisory GHSA-j9p7-hm85-9v77 and the VulnCheck Advisory on AVideo for technical details.

Detection Methods for CVE-2026-84480

Indicators of Compromise

• HTTP POST requests to userRecoverPassSave.json.php referencing recovery tokens issued days or weeks earlier than the request timestamp.
• Password change events for user accounts that did not initiate a recovery request in the corresponding time window.
• Successful logins from previously unseen IP addresses shortly after a password recovery event.
• Reuse of the same recovery token across multiple password reset submissions.

Detection Strategies

• Correlate password recovery token issuance timestamps with the timestamps of successful password changes to identify token reuse beyond a reasonable window.
• Alert on account password modifications that are not preceded by a fresh, user-initiated recovery request from the same session or client fingerprint.
• Inspect web server access logs for repeated calls to userRecoverPassSave.json.php with identical token values.

Monitoring Recommendations

• Enable verbose logging on the AVideo authentication and account recovery endpoints and forward logs to a centralized analytics platform.
• Monitor administrative account password changes with high-priority alerts and require out-of-band confirmation.
• Track anomalous geolocation or user-agent shifts immediately following password recovery activity.

How to Mitigate CVE-2026-84480

Immediate Actions Required

• Upgrade WWBN AVideo to the fixed release identified in the GitHub Security Advisory GHSA-j9p7-hm85-9v77.
• Invalidate all outstanding password recovery tokens in the database after applying the patch.
• Force a password reset for administrative and high-value accounts and review recent password change audit logs.
• Restrict network exposure of the AVideo administrative interface to trusted networks or VPN clients.

Patch Information

WWBN has released a fix through the AVideo project security advisory channel. Administrators should apply the patched version referenced in GHSA-j9p7-hm85-9v77 and the corresponding VulnCheck Advisory on AVideo. The fix introduces expiration validation on recovery tokens submitted to userRecoverPassSave.json.php.

Workarounds

• Temporarily disable the self-service password recovery feature and require administrator-driven password resets until the patch is applied.
• Deploy a web application firewall rule that rejects requests to userRecoverPassSave.json.php unless preceded by a same-session token issuance event.
• Shorten token lifetimes at the application layer by clearing recovery tokens from the database on a frequent schedule via a scheduled job.

# Example scheduled purge of stale recovery tokens (adapt table and column names to your schema)
mysql -u avideo_admin -p avideo_db -e \
  "UPDATE users SET recoverPass = NULL WHERE recoverPass IS NOT NULL AND modified < NOW() - INTERVAL 1 HOUR;"