AVIDEO · CVE-2026-126544 · Other
NO FIX YET
AVideo versions 6.5 through 29.7.1 have a flaw in the email verification code check, where PHP loose comparison of the recoverPass token can be exploited. A registered user can reuse the installation-wide salt from their own verification link to verify other accounts' emails and unlock features such as live streaming.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
AVideo installations in the 6.5 through 29.7.1 range are exposed where users can register and verify email addresses. Sites on other versions, or that do not run AVideo, can skip it. The sources do not describe further configuration conditions.
Not affected if versions-outside-range
Who cares avideo, php, self-hosted
objects/user.php for the User::verifyCode() function and its recoverPass comparison.No fix yet, per the sources.
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verification link and craft a code with arbitrary users_id and recoverPass set to true to verify other accounts' emails, unlocking features such as live streaming.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.