CVE-2026-33688

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at "objects/userRecoverPass.php" performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames...