WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at `objects/userRecoverPass.php` performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and without solving any captcha — by observing three distinct JSON error responses. Commit e42f54123b460fd1b2ee01f2ce3d4a386e88d157 contains a patch.

Affected: Packagist: wwbn/avideo

## Summary

The password recovery endpoint at `objects/userRecoverPass.php` performs user existence and account status checks **before** validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and without solving any captcha — by observing three distinct JSON error responses.

## Details

In `objects/userRecoverPass.php`, the request flow is:

1. **Line 11** — A `User` object is instantiated from unsanitized `$_REQUEST['user']` with no authentication: ```php $user = new User(0, $_REQUEST['user'], false); ```

2. **Lines 27-29** — If the user does not exist, a distinct error is returned immediately: ```php if (empty($user->getStatus())) { $obj->error = __("User not found"); die(json_encode($obj)); } ```

3. **Lines 31-33** — If the user exists but is not active, a different distinct error is returned: ```php if ($user->getStatus() !== 'a') { $obj->error = __("The user is not active"); die(json_encode($obj)); } ```

4. **Lines 37-41** — Captcha validation only occurs **after** both user enumeration checks: ```php if (empty($_REQUEST['captcha'])) { $obj->error = __("Captcha is empty"); } else { require_once 'captcha.php'; $valid = Captcha::validation($_REQUEST['captcha']); ```

This ordering creates a reliable oracle: requests that hit the captcha check confirm the user exists and is active, while the two earlier error messages reveal non-ex…