WWBN AVideo EUVD-2026-69722

Exploitation requires possession of a valid password-recovery token for the target account issued through AVideo's recovery flow; the vulnerability removes the time limit on that token so it works even long after issuance via userRecoverPassSave.json.php. The limiting factor is token acquisition - the attacker must first obtain the token (intercepted/leaked reset email, exposed logs, or prior access), which is why this is not a pure zero-prerequisite remote takeover despite the PR:N/UI:N vector; no authentication, user interaction, or non-default configuration is otherwise needed on a reachable AVideo instance.

The CVSS 4.0 base of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects that once a token is held, resetting the password is a trivial unauthenticated network request yielding full confidentiality, integrity and availability impact over the victim account. The practical gating factor not captured by the raw score is token acquisition: the attacker must first obtain a valid recovery token (via interception, a leaked reset email, log exposure, or a prior compromise), so this is realistically a chaining/opportunistic issue rather than a spray-and-pray one, and the impact is per-account rather than a direct server compromise. No EPSS score, KEV listing, or POC was provided, so exploitation-probability signals are absent; the finding rests on a credible VulnCheck advisory plus a vendor GHSA. Given AVideo instances typically expose recovery flows to the internet, any operator running it should treat token-handling as urgent and rotate/patch promptly regardless of organization size.

An attacker obtains a target user's password-recovery token (e.g., from a stale reset email, intercepted link, or log leak) that was issued days or weeks earlier and would normally be expired. Because userRecoverPassSave.json.php performs no expiration check, the attacker replays the old token to set a new password and logs in with full access to the victim's account. No authentication or user interaction is required at the moment of exploitation.