CVE-2026-84480: Insufficient Session Expiration in WWBN AVideo
Description
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
CVSS v4.0
Score 9.3critical
Affected software
WWBN
AVideo
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84480 describes an insufficient session expiration vulnerability in WWBN AVideo's password recovery mechanism. Specifically, the userRecoverPassSave.json.php endpoint fails to check whether a password recovery token has expired, permitting attackers to reuse expired tokens indefinitely. This allows an attacker who has obtained a recovery token to reset the associated account's password repeatedly, resulting in full account takeover.
Potential Impact
An attacker with access to a password recovery token can reset the victim's password at any time, bypassing intended expiration controls. This leads to full compromise of the affected user account without requiring additional privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious with password recovery tokens and consider additional protective measures such as monitoring for suspicious password reset activity.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-01T20:37:00.841Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9753b2acd9273b494a35d9
Added to database: 09/01/2026, 22:37:38 UTC
Last enriched: 09/07/2026, 13:46:15 UTC
Last updated: 10/16/2026, 06:48:19 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.