CVE-2026-86729

WWBN AVideo through commit e01e41ecc exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path that validates credentials with no throttling, unlike the primary get_api_signIn endpoint which limits clients to 10 attempts per 5 minutes. The endpoint also acts as a credential oracle: it returns the same 'Invalid credentials' message for correct and incorrect passwords, but the users_id field in the response reveals the outcome (users_id:1 on success, users_id:0 on failure). A correct guess additionally establishes a session cookie that remains usable for authenticated API requests. An unauthenticated remote attacker can therefore conduct unlimited password guessing against any account, including admin, and fully take over the account; any deployment running code up to commit e01e41ecc is affected, and no patched version is available yet. Exploitation has not been reported so far: EPSS is 0.2%, the flaw is not in CISA KEV, and no public proof-of-concept is known.

What to do: Because no patched version is available, mitigate by blocking or rate-limiting requests to the get_api_preauthorize endpoint (plugin/API/API.php) at a reverse proxy or WAF, and review logs for bursts of preauthorize calls targeting admin or other high-value accounts. Enforce strong passwords for AVideo accounts in the meantime, and monitor the upstream WWBN AVideo repository for a fix beyond commit e01e41ecc and upgrade as soon as one is published.