CVE-2023-49589 is a high severity flaw, scored 8.8, in the password recovery code of WWBN AVideo: recovery codes lack enough randomness, so an attacker can take over a user account. Cisco Talos says the vendor patched it on 15 December 2023.
What's affected
The record says an insufficient entropy flaw exists in the recoverPass generation of userRecoverPass.php in WWBN AVideo, dev master commit 15fed957fb, and that a specially crafted HTTP request can lead to arbitrary user password recovery. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Cisco Talos's report TALOS-2023-1896 agrees on the 8.8 High score and the tested commit. It says the vendor released a patch on 15 December 2023, one day after disclosure, and it does not name a specific fixed release. Talos locates the weakness in the setRecoverPass and createRecoverPass functions, which build recovery codes from the current time.
How to check if you're exposed
AVideo is deployed from source, so the check is about the commit you run. In your installation directory, read the current commit.
git log -1 --format=%H
Compare the date of your checkout with 15 December 2023. A deployment built from a commit older than the vendor's patch should be updated. Because Talos names no release number, confirm by reading the project's commit history for the change to the recovery code functions.
What to do now
- Find your AVideo deployments and the commit each one runs.
- Update to a build that includes the vendor's 15 December 2023 patch, and confirm in the commit history that the recovery code functions changed.
- Invalidate any pending password recovery requests after updating.
- Review accounts, especially administrators, for unexpected password resets or sign ins from new locations.
- Consider requiring multi factor authentication for administrators if your setup supports it.
Why it matters
The weakness is weak password recovery, CWE-640. Password reset is a second door into an account, and it has to be as hard to force as the front door. Talos reports that the code is derived from the current time, which makes it predictable.
The vector requires low privileges, which in practice means an account on the site. An attacker who can register can then target other users, including administrators. KEV status is false for this CVE, and I know of no claim of exploitation in the sources I read.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is predictable randomness a problem for reset codes?
A reset code is a secret. If it is derived from a value like the clock, an attacker can compute a short list of candidates instead of guessing blindly.
Sources
Cisco Talos report TALOS-2023-1896
Last reviewed: 19 October 2026.
