CVE-2026-82644

WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that silently discards writes for any client identified as a bot by isBot(). Because isBot() treats a missing User-Agent header as a bot by default — and also matches common bot identifiers such as 'curl', 'bot', 'crawler', and 'spider' — the counter never increments for such clients, so the rate limit never fires. An unauthenticated attacker can therefore submit unlimited login attempts (e.g., by omitting the User-Agent header or using curl's default User-Agent), enabling unrestricted password-guessing attacks.

• CWE-307

• https://github.com/WWBN/AVideo/security/advisories/GHSA-6893-mcgv-9p2x
• https://www.vulncheck.com/advisories/wwbn-avideo-brute-force-rate-limiting-bypass-via-missing-user-agent
• https://github.com/WWBN/AVideo/security/advisories/GHSA-6893-mcgv-9p2x

Published

Aug 30, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82639NextChat versions from 2.15.8 through 2.16.1 contain an impr…7.5
• CVE-2026-8264A weakness has been identified in Tenda AC6 15.03.06.23. Aff…8.8
• CVE-2026-82640browser-use web-ui versions 2.0.0 through 3.0.0 write config…5.5
• CVE-2026-82641Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind …8.6
• CVE-2026-82642Readest is an open-source e-book reader built on Tauri. In v…8.8
• CVE-2026-82643WWBN AVideo contains an unauthenticated credential submissio…6.5
• CVE-2026-82645AVideo (current commit e01e41ecc and earlier) exposes stream…8.6
• CVE-2026-82646WWBN AVideo contains an unauthenticated reflected cross-site…6.1
• CVE-2026-82647WWBN AVideo contains a cross-site request forgery vulnerabil…6.1
• CVE-2026-82648WWBN AVideo contains a server-side request forgery filter by…7.1
• CVE-2026-82649SiYuan Windows installer before version 3.8.1 (affected vers…7
• CVE-2026-8265A security vulnerability has been detected in Tenda AC6 15.0…7.2