Threats tagged 'ghsa-gg4j-m5p6-jfrg'

WWBN AVideo versions 6.5 through 29.7.1 have an email verification bypass vulnerability in the User::verifyCode() function due to PHP loose comparison of the recoverPass token. This flaw allows registered users to reuse the installation-wide salt from their own verification link to craft a code that can verify other users' email addresses, potentially unlocking features like live streaming for those accounts.