A critical flaw reported in WWBN AVideo would let anyone holding a password recovery token reuse it indefinitely to take over accounts, with a submitted CVSS v3.1 score of 9.8.
What Is It
According to the disclosure, WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php. If the endpoint does not check whether a token is still within its valid window, an attacker who obtains a recovery token could use it at any point in the future to reset the target account's password and gain full account access. The issue is tracked as CWE-613 (Insufficient Session Expiration) and was disclosed by VulnCheck. These mechanism details come from the submitter's record and have not yet been independently corroborated by NVD analysis.
Why It Matters
The CVSS v3.1 base score submitted with the record is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v4.0 score is 9.3 (CRITICAL). As scored, the attack is remote over the network, low complexity, and requires no privileges and no user interaction, with high confidentiality, integrity, and availability impact. These metrics are supplied by the CNA and may change during NVD analysis.
If the described behavior holds, the practical consequence is that recovery tokens stop being time-bounded secrets. A token leaked through mailbox access, log exposure, forwarded email, or a stale message would retain full password-reset power indefinitely; turning a one-time credential into a persistent path into the associated account.
What's Vulnerable
Per the vendor-supplied affected data:
- Vendor: WWBN
- Product: AVideo
- Affected versions: all versions up to and including 29.0 (
<= 29.0); default status for other versions is unaffected
No CPE entries are listed in the NVD record at this time, and the affected-version range has not been validated by NVD.
Patch Status
As of publication, CVE-2026-84480 has no entry in CISA's Known Exploited Vulnerabilities catalog, so no KEV-mandated required action or due date applies. Absence from the KEV catalog is not evidence that exploitation is not occurring; it indicates only that CISA has not confirmed it. Exploit maturity in the CVSS v4.0 vector is NOT_DEFINED.
The NVD record was published 2026-09-01 and remains in Received status, meaning NVD analysis is not yet complete and the details above, including the severity scores, affected versions, and the technical description, may be revised or rejected. No fixed version is stated in the supplied data; operators should consult the vendor's GitHub security advisory (GHSA-j9p7-hm85-9v77) for remediation guidance and to confirm whether their deployment is affected.
Sources
- NVD, CVE-2026-84480 (source: [email protected], published 2026-09-01, status: Received)
- WWBN AVideo GitHub Security Advisory GHSA-j9p7-hm85-9v77; https://github.com/WWBN/AVideo/security/advisories/GHSA-j9p7-hm85-9v77
- VulnCheck Advisory, WWBN AVideo Password Recovery Token Expiration Bypass, https://www.vulncheck.com/advisories/wwbn-avideo-password-recovery-token-expiration-bypass
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog