CVE-2026-82644

WWBN AVideo's enforceRateLimit() function, which throttles authentication attempts on login.json.php and 13 other endpoints, stores its attempt counter in a cache layer that silently discards writes for any client classified as a bot. Because isBot() treats a missing User-Agent header as a bot by default and also matches common identifiers such as 'curl', 'bot', 'crawler', and 'spider', the counter never increments for such requests and the rate limit never triggers. An unauthenticated attacker can therefore submit unlimited login attempts — for example by omitting the User-Agent header or using curl's default User-Agent — enabling unrestricted password-guessing attacks against the login endpoint and the other 13 protected endpoints. Anyone running WWBN AVideo through the current commit e01e41ecc and earlier, with these endpoints reachable by untrusted clients, is affected. No public proof-of-concept is known, the flaw is not in CISA's KEV, and EPSS currently estimates a 0.3% probability of exploitation within 30 days.

What to do: Apply the vendor's fix in the AVideo repository as soon as a patched release is published, since no fixed version is identified in the available data. In the interim, restrict public access to login.json.php and the other 13 rate-limited endpoints, or apply rate limiting at a reverse proxy/WAF layer, and monitor authentication logs for brute-force patterns (especially requests with missing or curl-style User-Agent headers). Ensure accounts on exposed instances use strong passwords while the bypass remains unpatched.