CVE-2026-84479

WWBN AVideo (current commit e01e41ecc and earlier) relies solely on the client-supplied User-Agent header to decide whether three login-time security controls apply, an authentication-control flaw classified as CWE-290 (authentication bypass by spoofing). An attacker who already holds valid credentials can send User-Agent: AVideoEncoder or AVideoMobileApp; because the isAVideoEncoder()/isAVideoMobileApp() checks match these hardcoded literals with no IP check or shared secret, the server treats the login as coming from a trusted encoder or mobile app. The attacker therefore bypasses two-factor authentication, skips brute-force captcha escalation, and is not recorded in the login/device audit history, meaning 2FA-protected accounts can be accessed with just the password and logins become invisible to defenders. All AVideo deployments running e01e41ecc or earlier are affected, and no patch is available at the time of publication. No public proof-of-concept or in-the-wild exploitation is known; EPSS estimates a 0.3% probability of exploitation within 30 days.

What to do: No fixed version exists yet, so watch the WWBN AVideo repository or vendor channels and upgrade as soon as a patch is released. Until then, restrict access to the login endpoint (for example via IP allowlisting or a reverse-proxy rule that normalizes or strips the User-Agent on login requests), and treat audit history as incomplete because logins sent with the AVideoEncoder/AVideoMobileApp User-Agents are not logged. Since the attacker must already possess valid credentials, prioritize strong password hygiene and review accounts that rely on 2FA as their primary protection.