WWBN AVideo Brute-Force Rate Limit Bypass (CVE-2026-82644)

Executive Summary

A rate-limiting bypass vulnerability (CVE-2026-82644) has been disclosed in WWBN AVideo, an open-source video platform, affecting the current build (e01e41ecc) and earlier. The flaw lives in the enforceRateLimit() function that is supposed to protect login.json.php and 13 other endpoints from brute-force attacks. Because the underlying attempt counter silently discards writes for any client the platform classifies as a bot, an attacker can trivially disable rate limiting and submit unlimited login attempts. The issue carries a CVSS score as high as 8.7 (NVD lists 7.5), and was assigned by VulnCheck.

Vulnerability Overview

Technical Details

enforceRateLimit() tracks failed attempts per client using a cache layer (ObjectYPT::setCacheGlobal). Before recording an attempt, the function checks whether the requesting client looks like a bot via isBot(). If isBot() returns true, the cache write is skipped entirely — meaning that client's attempt counter never increments and the rate limit never fires.

The problem is that isBot() is far too permissive:

• A request with no User-Agent header at all is treated as a bot by default.
• Common tool identifiers such as curl, bot, crawler, and spider are also matched as bots.

Since tools like curl send a User-Agent: curl/x.y.z string by default, an attacker doesn't even need to craft anything unusual — the default behavior of common scripting and command-line HTTP clients is enough to permanently bypass the rate limiter.

1. Attacker sends login attempts to login.json.php (or one of 13 other endpoints)
2. Request omits User-Agent, or uses curl's default User-Agent string
3. enforceRateLimit() calls isBot() -> returns true
4. Attempt counter write is silently discarded via ObjectYPT::setCacheGlobal
5. No lockout is ever triggered, regardless of attempt volume
6. Attacker performs unrestricted password-guessing against valid accounts

A closely related flaw disclosed at the same time, CVE-2026-82643, compounds the risk: plugin/Live/api/preauthorize.json.php accepts credentials over GET without rate limiting, letting attackers repeatedly submit correct credentials to trigger uncapped two-factor confirmation emails while also brute-forcing accounts.

Impact

Remediation

WWBN has not published a patched build referenced in public advisories as of this writing. Until an official fix is confirmed, apply the following mitigations:

1. Front the application with a WAF or reverse proxy that enforces its own rate limiting independent of the application-layer counter, keyed on IP address rather than client-reported headers.
2. Do not trust User-Agent for security decisions — if you maintain a fork or custom build, key rate-limit tracking on IP address and session, and treat missing/bot-like User-Agent strings as higher risk, not an exemption.
3. Enforce strong, unique passwords and MFA on all accounts to reduce the impact of unrestricted guessing.
4. Monitor authentication logs for high-volume login attempts from a single source, especially those with missing or generic (curl, bot, crawler) User-Agent strings.
5. Restrict access to login.json.php and admin endpoints at the network layer where public exposure isn't required.

Detection

References

• GitHub Security Advisory GHSA-6893-mcgv-9p2x
• NVD — CVE-2026-82644