WWBN AVideo CVE-2026-82643

The WWBN AVideo Live plugin must be installed and active - this is not a core AVideo vulnerability but is specific to the Live plugin component. The endpoint plugin/Live/api/preauthorize.json.php must be publicly reachable over the network. No authentication, special configuration, or user interaction is required; exploitation works against default network-accessible deployments with the Live plugin enabled. Limiting factors include: the attacker must know or enumerate valid usernames, and brute-force success depends on password strength. IP-based blocking or upstream rate limiting (CDN, load balancer) would constrain single-source attacks.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L) yields a score of 6.9 (Medium), reflecting the low-complexity remote unauthenticated nature of the attack but conservatively rating impact as low on both integrity and availability. This scoring is reasonable: the vulnerability does not itself exfiltrate data or execute code, but it materially enables account compromise through brute force. EPSS data is absent from available intelligence, limiting probabilistic exploitation likelihood assessment. Neither KEV listing nor public exploit code has been identified. The practical risk is elevated for deployments with weak or reused user passwords and where the Live plugin is active, since successful credential guessing would yield full account takeover. The email-flooding vector creates a denial-of-service condition against users and potentially against mail infrastructure. Overall, this is a genuine medium-priority issue - not a theoretical edge case - but unlikely to be a primary target for mass exploitation given AVideo's limited deployment footprint.

An unauthenticated attacker sends a high-volume series of HTTP GET requests to /plugin/Live/api/preauthorize.json.php, cycling through common or previously breached passwords for a known username. Because no rate limiting or lockout exists, the attacker can programmatically iterate thousands of credential pairs per minute until a valid combination is accepted, or deliberately flood a targeted user with 2FA emails as a harassment or denial-of-service action. No exploit code is publicly known, but the attack is trivially implementable with standard HTTP tooling such as curl or Burp Intruder.