AVideo Password Recovery Token Expiration Bypass

AVideo, a video sharing platform, has a vulnerability in its password recovery process. The script userRecoverPassSave.json.php does not validate the expiration of recovery tokens, allowing attackers to use expired tokens to reset account passwords indefinitely.

An attacker with access to a recovery token can use it at any time to change the target account's password and gain full account access.