CVE-2026-84480CWE-613

CVE-2026-84480

Critical · published September 2, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-09-02T03:17Z
References (2)
https://github.com/WWBN/AVideo/security/advisories/GHSA-j9p7-hm85-9v77 · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-password-recovery-token-expiration-bypass · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 22:25Z
    WWBN AVideo Password Recovery Token Expiration Bypass
    cvelistv5