WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUse…
High CVSS 7.3
Summary
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requirement, no CSRF/global token, no relationship check between caller and target, and no enforceRateLimit() call. The only intended throttle is keyed to the caller's own se…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/WWBN/AVideo/security/advisories/GHSA-rg4h-fcmm-8w26
- https://www.vulncheck.com/advisories/wwbn-avideo-userverifyemail-php-unauthenticated-access-control
- https://github.com/WWBN/AVideo/security/advisories/GHSA-rg4h-fcmm-8w26
Timeline
- nvd_ingest NVD