External risk intelligence

WWBN AVideo Password Recovery Token Bypass Allows Indefinite Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-84480

WWBN AVideo is a web-based video platform typically deployed as a public-facing web application. Password recovery functionality is a standard, internet-accessible feature of such web services, making the vulnerable endpoint reachable from the public internet in common deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in WWBN AVideo allows attackers to exploit an issue with password recovery tokens, potentially enabling them to reset account passwords indefinitely and gain unauthorized access to user accounts. The main concern is confirming relevance and exposure within your environment.

Expired password recovery tokens can grant permanent account access.
Protects against unauthorized account takeover risks.
Assess your use of this video platform.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by first obtaining a password recovery token, which might be achievable through various means not specified. Once the token is acquired, the attacker can bypass the intended expiration by repeatedly sending requests to the vulnerable `userRecoverPassSave.json.php` endpoint, effectively resetting the target account's password indefinitely and gaining unauthorized access.

Entry condition: Obtain a password recovery token.
Trigger point: Submitting expired recovery tokens repeatedly.
Resulting risk: Indefinite account takeover.

Live Threat

Current exploitation, exposure, and threat context

WWBN AVideo's password recovery mechanism could allow an attacker to indefinitely reset account passwords using expired tokens. This could enable unauthorized access to user accounts.

User account passwords could be compromised.
Attackers may use expired tokens to reset passwords.
Indefinite account access could be granted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in WWBN AVideo's password recovery mechanism requires immediate attention from teams responsible for application security and the specific AVideo instances. The first practical step is to identify all deployments of WWBN AVideo, confirm their internet accessibility and business criticality, and then locate the designated owner for each instance to plan remediation.

Application owners should manage the fix.
Verify internet exposure and critical impact.
Coordinate vendor outreach and maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WWBN AVideo?

WWBN AVideo is an open-source, web-based video platform designed for hosting, managing, and streaming video content. It functions as a content management system where users can register accounts, upload media, and interact with video libraries. Because it manages user identities and authentication, it includes standard features like password recovery services to help users regain access to their accounts.

What is the vulnerability in CVE-2026-84480?

This CVE involves an insufficient session expiration flaw, classified as CWE-613. In plain terms, the software fails to properly check if a password recovery token has expired. Normally, these tokens are meant to be temporary, one-time-use keys. Because the system does not enforce a time limit, an attacker can use an old or expired token to reset a password at any time, effectively bypassing security controls meant to protect user accounts.

How do attackers trigger this password reset issue?

To trigger the vulnerability, an attacker must first obtain a valid password recovery token, such as by monitoring communications or finding them in logs. Once a token is held, the attacker sends it to the userRecoverPassSave.json.php endpoint. The bug occurs because the application accepts this token regardless of its age. Note that simply browsing the site or sending random data does not trigger this; the attacker must possess a specific token associated with an account.

Is my instance of WWBN AVideo at risk?

Halo Surface Signal notes that WWBN AVideo is typically deployed as a public-facing web application. Since password recovery is an internet-accessible feature, your instance is likely reachable by anyone on the internet. If your AVideo deployment is accessible externally, it faces a higher risk of exploitation compared to those restricted to internal, private networks.

How should I respond to this security advisory?

Begin by creating an inventory of all AVideo installations in your environment to understand your footprint. Identify the business owners for each instance and confirm if they are exposed to the public internet. Prioritize these instances for maintenance, coordinate with your security team to monitor for unusual password reset activity, and reach out to the vendor for the official update to resolve the token expiration logic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.