Vulnerabilidad · Publicado 17/09/2026
WWBN AVideo contiene una vulnerabilidad alta de control de acceso en el script objects/userVerifyEmail.php que permite a atacantes invocar funciones de verificación de usuario sin estar autenticados, sin validación de tokens CSRF y sin verificar relación entre usuario y atacante. No existe parche disponible. Plataformas de video, portales educativos y sistemas de streaming en LATAM que usen esta versión están expuestos a ataques de suplantación de identidad y acceso no autorizado a cuentas.
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requirement, no CSRF/global token, no relationship check between caller and target, and no enforceRateLimit() call. The only intended throttle is keyed to the caller's own session, so cookie-less requests are never limited. An unauthenticated remote attacker can therefore cause an arbitrary number of verification emails to be sent to any account ID, and can enumerate accounts and their verification status from the three distinct JSON responses ("Verification Sent", "Already verified", "Unknown error"). In addition, createVerificationCode() invokes $user->setRecoverPass() and saves the user, so each anonymous request writes a live password-recovery token onto the targeted account; that token is embedded in base64 in the verification link emailed to the account owner and is accepted by objects/userRecoverPassSave.json.php as the credential for setting a new password.
Score: 7.3/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-770
Publicado en NIST NVD.