A critical vulnerability in WWBN AVideo allows unauthenticated attackers to perform account takeovers by exploiting improper password recovery token validation.

This vulnerability is caused by insufficient session expiration (CWE-613) within the userRecoverPassSave.json.php file. An unauthenticated attacker can leverage expired recovery tokens to indefinitely reset passwords for any account.

The ability for an unauthenticated attacker to reset passwords for arbitrary user accounts poses a severe risk to organizational data and system integrity. Given the 9.8 CVSS score, this flaw is categorized as critical, as it facilitates full account takeover, potentially leading to unauthorized access to sensitive video content, user data, and administrative functions.

Immediate Action: Update WWBN AVideo to the latest version, which includes the necessary validation logic to enforce password recovery token expiration.

Proactive Monitoring: Review web access logs for unusual patterns of requests to userRecoverPassSave.json.php, specifically looking for repeated attempts or anomalous timing related to password reset flows.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to limit the rate of requests to password recovery endpoints, which may impede automated exploitation attempts until patching is complete.

Public Exploit Available: No

This vulnerability represents a significant security risk due to the potential for widespread account compromise. Administrators must prioritize updating AVideo to the latest version immediately to ensure that password recovery tokens are properly invalidated after use or expiration. Failure to remediate this flaw could result in complete loss of control over the affected AVideo platform.