CVE-2020-37172 is a password recovery weakness in AVideo Platform 8.1 from WWBN, scored 5.3 (medium). The record describes a cross site request forgery style attack on the recoverPass endpoint that changes account credentials. No fixed version is named, so upgrade to the current AVideo release and review accounts.
What's affected
The record lists AVideo Platform 8.1 by wwbn. The affected feature is the password recovery mechanism, specifically the recoverPass endpoint, used together with a user's recovery token.
The CVSS vector is AV:N/AC:L/PR:N/UI:N with low integrity impact only. The record does not name a fixed version. AVideo is developed in the open on GitHub, so the project repository and release notes are the place to confirm which later releases changed this behavior.
How to check if you're exposed
AVideo is a self hosted PHP application. Check your instance.
- Open the admin page or the project files to find your AVideo version. If it is 8.1, you are in scope.
- Check whether password recovery is enabled for your site.
- Review account activity for unexplained password changes or recovery emails that users did not request.
- Compare your version against the latest release on the project repository.
What to do now
- Back up the AVideo files and database.
- Upgrade to the latest release from the WWBN repository, since 8.1 is old.
- Ask users to confirm any recent password reset emails they did not request, and force resets for accounts with suspicious activity.
- Make sure the site is served over HTTPS and that recovery links expire quickly.
- Consider disabling password recovery temporarily if you cannot upgrade right away.
Why it matters
The record classifies the flaw as CWE-640, weak password recovery mechanism for forgotten password. Recovery flows are a favorite target because they exist to change a credential without the current password. Any weakness in how the token is checked or how the request is verified can turn into account takeover.
Good recovery design ties the request to a single use token with a short life, requires a user action that cannot be forged by another site, and tells the account owner when a reset happens. Check each of those in any application you run, not only this one.
Quick check
Is a 5.3 score safe to ignore?
Not for an account system. The score reflects limited technical impact, but a changed password on an admin or channel owner account can matter more than the number suggests.
Sources
Last reviewed: 19 October 2026.
