CVE-2026-84480

Received Received - Intake

Password Reset Token Expiration Bypass in AVideo

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84480

EUVD

EUVD-2026-69722

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

WWBN AVideo does not check if a password recovery token has expired. This allows attackers to use old tokens to reset passwords at any time, gaining full access to the account.

Detection Guidance

To detect this vulnerability, monitor for unauthorized password reset attempts or successful password changes without recent recovery token requests. Check server logs for repeated access to userRecoverPassSave.json.php with expired tokens. Look for unusual account activity like password changes on accounts without recent recovery requests.

Impact Analysis

If you use AVideo and request a password reset, an attacker could steal or reuse an old token to take over your account. This could lead to loss of data, unauthorized actions, or identity theft.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by allowing unauthorized access to personal or sensitive data, leading to non-compliance and potential legal consequences.

Mitigation Strategies

Immediately update AVideo to the latest patched version to fix the token expiration validation issue. If an update is not available, disable the password recovery feature temporarily or restrict access to userRecoverPassSave.json.php until a patch is applied.

Hi! I’m here to help you understand CVE-2026-84480. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70