WWBN AVideo CVE-2026-82644

The bypass requires only that the attacking client omit the User-Agent header entirely - the default behavior in some scripting and automation contexts - or send a User-Agent string matching patterns such as 'curl', 'bot', 'crawler', or 'spider'. No authentication, no account, no elevated privilege, and no non-default server configuration is required; the flaw is present in default deployments of AVideo wherever the login endpoint is network-accessible. Exploitation is constrained by the need to reach the target endpoints over the network, so AVideo instances deployed exclusively on internal networks with strict perimeter controls face substantially lower immediate risk. Successful exploitation of the bypass does not itself grant access - the attacker still requires valid credentials matched from a password list or prior breach data, so accounts protected by strong, unique passwords remain resistant even under unlimited guessing.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) accurately reflects the near-trivial exploitation conditions: omitting the User-Agent header or using curl's default agent string is a one-line change to any HTTP client, requiring no target-specific knowledge beyond the endpoint URL. The high confidentiality impact (VC:H) is well-founded given that successful credential enumeration yields full account access. EPSS data is absent from the input, so exploitation probability cannot be quantified; the absence of a CISA KEV listing means active exploitation is not confirmed at time of writing. Despite the lack of KEV confirmation, the exploitability profile is effectively equivalent to a misconfigured open endpoint - the bypass requires no exploit kit and is fully reproducible by anyone reading the advisory. Organizations running AVideo as a public-facing service should prioritize remediation; the rate-limiting mechanism being silently defeated means all accounts protected only by that control are exposed to unconstrained credential guessing.

An attacker targeting a publicly accessible AVideo instance uses curl or any scripted HTTP client with the User-Agent header stripped, sending a continuous stream of POST requests to login.json.php while cycling through a credential list. Because each request is misclassified as a bot and the attempt counter is never written to cache, no lockout or throttle is triggered regardless of request volume. No publicly available POC code has been identified, but the technique is fully described in the advisory and requires no specialized tooling beyond a standard HTTP client.