CVE-2026-92915 WWBN AVideo userVerifyEmail.php Unauthenticated Access Control
Unauthenticated attackers can enumerate users and trigger password recovery tokens, potentially leading to account takeover via verification email links.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92915?
CVE-2026-92915 is a medium-severity missing authorization vulnerability in WWBN AVideo, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requirement, no CSRF/global token, no relationship check between caller and target, and no enforceRateLimit() call. The only intended throttle is keyed to the caller's own session, so cookie-less requests are never limited. An unauthenticated remote attacker can therefore cause an arbitrary number of verification emails to be sent to any account ID, and can enumerate accounts and their verification status from the three distinct JSON responses ("Verification Sent", "Already verified", "Unknown error"). In addition, createVerificationCode() invokes $user->setRecoverPass() and saves the user, so each anonymous request writes a live password-recovery token onto the targeted account; that token is embedded in base64 in the verification link emailed to the account owner and is accepted by objects/userRecoverPassSave.json.php as the credential for setting a new password.
Weakness: CWE-770
Which versions are affected by CVE-2026-92915?
How do I fix CVE-2026-92915?
No fix has been published for CVE-2026-92915 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-92915 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92915 exists.
Sources
Also known as GHSA-rg4h-fcmm-8w26, GHSA-wphj-4v3g-8q6c.