Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-84480: WWBN AVideo allows expired password reset links to work
CVE-2026-84480 · published 1 day ago
Summary
The AVideo platform does not check whether a password reset link has expired, so a link that should no longer be valid can still be used to change a user's password. If someone obtains such a link, they can reset the account password at any time and take full control of the account. Apply the latest update from the vendor or patch the code to enforce expiration checks on password reset tokens.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wwbn | avideo | <= 29.0 |
Original advisory text
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obt...
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-j9p7-hm85-9v77 vendor-advisory
- https://www.vulncheck.com/advisories/wwbn-avideo-password-recovery-token-expirat... third-party-advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84480... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84480 Vendor Advisory
Severity
9.3
Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-613Insufficient Session Expiration
Timeline
Published1 Sep 2026
Updated2 Sep 2026
First seen2 Sep 2026
Monitor software like this
Free during beta