CVE-2026-84476

WWBN AVideo does not validate that requests carrying X-Real-IP or X-Forwarded-For headers originate from a trusted proxy, so any remote client can dictate the client IP address the application records (CWE-290, authentication bypass by spoofing). An attacker sends login requests with a different spoofed header value on each attempt, and the rotating 'client IP' defeats the per-IP counter in enforceRateLimit(). This removes the throttle on failed logins, enabling unlimited and hard-to-detect password guessing against AVideo user accounts. All WWBN AVideo deployments that honor forwarded headers, particularly those fronted by reverse proxies or load balancers, are affected; the available data does not specify vulnerable version ranges. No exploitation has been confirmed: there is no public PoC, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.3% (18th percentile), despite the high severity score of 8.7.

What to do: Upgrade AVideo to the vendor's patched release as soon as it is published; no fixed version number is given in the available data, so check the WWBN/AVideo repository or advisory for the patched version. Until then, configure a trusted-proxy allowlist so X-Real-IP and X-Forwarded-For are honored only from known proxy addresses (or stop honoring these headers entirely), and enforce login rate limiting or account lockout at the reverse proxy, WAF, or firewall layer. Review authentication logs for failed-login bursts attributed to many distinct rotating source addresses, which would indicate spoofing-driven credential guessing.