CVE-2026-126544

WWBN AVideo versions 6.5 through 29.7.1 are vulnerable to an email verification bypass within the User::verifyCode() function in objects/user.php. The root cause is a PHP loose comparison of the recoverPass token. This allows registered users to reuse an installation-wide salt from their own veri...