WWBN AVideo up to 29.0 Email Verification userVerifyEmail.php sendVerificationLink users_id access control

Summaryinfo

A vulnerability, which was classified as critical, has been found in WWBN AVideo up to 29.0. This vulnerability affects the function User::sendVerificationLink of the file objects/userVerifyEmail.php of the component Email Verification. Performing a manipulation of the argument users_id results in access control. This vulnerability is known as CVE-2026-92915. Remote exploitation of the attack is possible. No exploit is available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 29.0. It has been classified as critical. This affects the function User::sendVerificationLink of the file objects/userVerifyEmail.php of the component Email Verification. The manipulation of the argument users_id with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requirement, no CSRF/global token, no relationship check between caller and target, and no enforceRateLimit() call. The only intended throttle is keyed to the caller's own session, so cookie-less requests are never limited. An unauthenticated remote attacker can therefore cause an arbitrary number of verification emails to be sent to any account ID, and can enumerate accounts and their verification status from the three distinct JSON responses ("Verification Sent", "Already verified", "Unknown error"). In addition, createVerificationCode() invokes $user->setRecoverPass() and saves the user, so each anonymous request writes a live password-recovery token onto the targeted account; that token is embedded in base64 in the verification link emailed to the account owner and is accepted by objects/userRecoverPassSave.json.php as the credential for setting a new password.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-92915 since 09/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

By approaching the search of inurl:objects/userVerifyEmail.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch e01e41ecc is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion