CVE-2026-92915: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-92915 Overview

CVE-2026-92915 is a broken access control flaw in WWBN AVideo through commit e01e41ecc. The vulnerable script objects/userVerifyEmail.php disables the login requirement, accepts users_id directly from the query string, and calls User::sendVerificationLink() without session validation, CSRF tokens, relationship checks, or rate limiting. An unauthenticated remote attacker can trigger unlimited verification emails to any account and enumerate valid accounts through three distinct JSON responses. Worse, createVerificationCode() writes a live password-recovery token to the target account on every request, which is then emailed to the victim and accepted by objects/userRecoverPassSave.json.php as a credential for setting a new password.

Critical Impact
Unauthenticated attackers can enumerate accounts, flood users with verification emails, and overwrite live password-recovery tokens on any account, enabling account takeover if the victim's mailbox is accessed.

Affected Products

WWBN AVideo through commit e01e41ecc
No patched version is currently available
Affected component: objects/userVerifyEmail.php

Discovery Timeline

2026-09-17 - CVE-2026-92915 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92915

Vulnerability Analysis

The flaw resides in objects/userVerifyEmail.php, which explicitly disables authentication by setting $global['ignoreUserMustBeLoggedIn'] = 1. The script then reads the users_id parameter directly from the query string and passes it to User::sendVerificationLink(). No CSRF token, no global anti-automation token, and no relationship check between the caller and the target user is enforced. The intended throttle mechanism uses enforceRateLimit() keyed to the caller's session, so cookie-less requests bypass throttling entirely. This weakness is classified as unrestricted resource allocation [CWE-770].

Beyond email flooding and account enumeration, the endpoint invokes createVerificationCode(), which calls $user->setRecoverPass() and saves the user object. Each anonymous HTTP request therefore writes a fresh password-recovery token onto the targeted account. The token is embedded in base64 inside the verification link delivered to the account owner and accepted by objects/userRecoverPassSave.json.php as valid credentials to set a new password.

Root Cause

The root cause is the combination of disabled authentication, unvalidated user-supplied users_id input, and a session-scoped rate limiter that does not apply to unauthenticated callers. Coupling verification email generation with password-recovery token creation compounds the impact.

Attack Vector

An unauthenticated remote attacker issues repeated HTTP GET requests to objects/userVerifyEmail.php with iterated users_id values. Distinct JSON responses (Verification Sent, Already verified, Unknown error) allow account enumeration. Each successful call overwrites the target account's password-recovery token and emails a working recovery link to the victim.

Technical details are documented in the GitHub Security Advisory GHSA-rg4h-fcmm-8w26 and the VulnCheck Advisory on AVideo.

Detection Methods for CVE-2026-92915

Indicators of Compromise

High volume of unauthenticated GET requests to objects/userVerifyEmail.php with sequentially varying users_id values.
Spikes in outbound verification emails from the AVideo host without corresponding user registrations.
User reports of unsolicited email verification or password-reset messages.
Repeated writes to the recovery-token column of the users table without matching authenticated password-reset flows.

Detection Strategies

Alert on requests to userVerifyEmail.php that originate from clients without a valid session cookie.
Monitor for the three distinct JSON response bodies (Verification Sent, Already verified, Unknown error) served to the same source IP within short time windows, indicating enumeration.
Correlate web access logs with mail server logs to identify bursts of verification emails triggered by a single upstream IP.

Monitoring Recommendations

Enable verbose access logging on the AVideo web server and forward logs to a centralized analytics platform.
Track per-IP request rates against objects/userVerifyEmail.php and objects/userRecoverPassSave.json.php.
Audit database changes to the recoverPass field to detect unauthorized token overwrites.

How to Mitigate CVE-2026-92915

Immediate Actions Required

Restrict access to objects/userVerifyEmail.php at the web server or reverse proxy layer until an official patch is available.
Enforce IP-based rate limiting on the endpoint to block unauthenticated bulk requests.
Notify users to disregard unexpected password-reset emails and to change passwords if suspicious activity occurs.

Patch Information

No patched version is available at the time of publication. Monitor the GitHub Security Advisory GHSA-rg4h-fcmm-8w26 for upstream fixes. Once available, apply the vendor patch and audit user accounts for tampered recovery tokens.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests to objects/userVerifyEmail.php lacking a valid authenticated session cookie.
Add server-side IP throttling in front of the endpoint to cap requests per minute per source address.
Temporarily disable the verification endpoint if verification flows are not business-critical.
Invalidate any active password-recovery tokens generated during the exposure window and require password rotation for high-value accounts.

bash

# Example nginx configuration to rate-limit and require a session cookie
limit_req_zone $binary_remote_addr zone=verify_zone:10m rate=5r/m;

location = /objects/userVerifyEmail.php {
    limit_req zone=verify_zone burst=5 nodelay;
    if ($http_cookie !~* "PHPSESSID=") {
        return 403;
    }
}