CVE-2026-126544

Name of the Vulnerable Software and Affected Versions AVideo versions 6.5 through 29.7.1

Description An email verification bypass exists in the User::verifyCode() function within the objects/user.php file. This issue is caused by a PHP loose comparison of the recoverPass token. Registered users can leverage the installation-wide salt from their own verification link to craft a request using an arbitrary users id and setting recoverPass to true. This allows the verification of other accounts' emails, which can unlock restricted features such as live streaming.

Recommendations Update AVideo to a version later than 29.7.1. As a temporary mitigation, restrict access to the User::verifyCode() function in objects/user.php until the update is applied.