---
id: CVE-2026-92915
title: >-
  WWBN AVideo through commit e01e41ecc (no patched version available) contains a
  broken access control flaw in objects/userVerifyEmail.php
summary: >-
  WWBN AVideo through commit e01e41ecc (no patched version available) contains a
  broken access control flaw in objects/userVerifyEmail.php. The script disables
  the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes
  users_id…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-770
vendor: WWBN
product: AVideo
affected:
  - AVideo <= 29.0
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T15:17:00.263'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92915'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-rg4h-fcmm-8w26'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/wwbn-avideo-userverifyemail-php-unauthenticated-access-control
    label: disclosure@vulncheck.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-rg4h-fcmm-8w26'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-17T14:25:51.814441Z'
ingestedAt: '2026-09-17T12:16:56.814Z'
epss: 0.00308
epssPercentile: 0.23769
---

## Overview

WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requirement, no CSRF/global token, no relationship check between caller and target, and no enforceRateLimit() call. The only intended throttle is keyed to the caller's own session, so cookie-less requests are never limited. An unauthenticated remote attacker can therefore cause an arbitrary number of verification emails to be sent to any account ID, and can enumerate accounts and their verification status from the three distinct JSON responses ("Verification Sent", "Already verified", "Unknown error"). In addition, createVerificationCode() invokes $user->setRecoverPass() and saves the user, so each anonymous request writes a live password-recovery token onto the targeted account; that token is embedded in base64 in the verification link emailed to the account owner and is accepted by objects/userRecoverPassSave.json.php as the credential for setting a new password.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.