CVE-2026-126544

WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrar...