CVE-2026-84480Critical· 9.8▾ MidnightWWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any t…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.5%
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-54547Medium· 5.3On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired
CVE-2026-9705Medium· 6.5Keycloak: Attacker can re-enable and take over disabled clients via registration access token
GHSA-q929-g23j-2rc7Medium· 6.5Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token
CVE-2026-118665HighGraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
CVE-2026-116894Medium· 4.2REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
CVE-2026-117499Low· 3.7@fastify/session vulnerable to session revocation bypass via a logout race condition