WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control vulnerability in objects/userVerifyEmail.php. The script disables login requirements and accepts user IDs directly from query strings without session validation, CSRF tokens, or relationship checks. It lacks effective rate limiting for unauthenticated requests, enabling attackers to send unlimited verification emails to any account. Additionally, the vulnerability causes the creation of live password recovery tokens embedded in emailed verification links, which can be used to reset passwords without authentication.

An unauthenticated remote attacker can abuse this flaw to send an arbitrary number of verification emails to any user account, potentially leading to email spam and denial of service against users. The attacker can also enumerate user accounts and their verification status via distinct JSON responses. More critically, the attacker can inject valid password recovery tokens into targeted accounts, enabling unauthorized password resets and account takeover without authentication.

No official patch or fix version is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to restrict access to the affected script, implement rate limiting on verification email requests, and monitor for suspicious activity related to password recovery processes.