🚨 CVE-2026-84480
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
🎖@cveNotify
GitHub
Password recovery tokens never expire: userRecoverPassSave.json.php skips the validity check, allowing account takeover with an…
### Summary
`objects/userRecoverPassSave.json.php` accepts a password-recovery token by comparing it directly to the stored value:
```php
} elseif ($user->getRecoverPass() !== $_POST['...
September 1, 2026 9
