WWBN AVideo CVE-2026-86186

No special attacker-side configuration is required beyond setting a bot User-Agent header (any string recognized by AVideo's middleware as a bot) in HTTP requests to the API. The vulnerable condition is inherent to the application's rate-limiting design and affects all AVideo deployments regardless of configuration or deployment mode - no non-default settings are required. All eight rate-limited operations are affected, with the login endpoint representing the highest-impact target. Exploitation is limited by the quality of target account passwords and the presence of MFA; accounts protected by MFA are not directly compromised by credential brute-force alone. Network-level access to the AVideo API HTTP port is required.

The CVSS 4.0 score of 6.3 with AT:P reflects a moderate severity with a specific prerequisite, but the practical exploitation complexity is very low - setting an HTTP header is trivial. The real-world impact is the removal of all application-layer brute-force protection, enabling credential stuffing at network speed from a single IP without triggering lockout. Even a mid-sized municipal IT team in legnica deploying AVideo for internal media sharing should treat this as a meaningful credential-exposure risk where user accounts lack MFA. The wildcard CPE range (all versions affected) and the absence of a confirmed patched release amplify urgency. No KEV listing and no EPSS data are present in the source intelligence, and no public exploit code is confirmed - exploitation feasibility is inferred from the trivially simple bypass mechanism. The primary mitigating factor is password quality and the presence of out-of-band MFA on targeted accounts.

An attacker uses a scripted HTTP client to POST login requests to the AVideo API with a User-Agent string such as 'Googlebot/2.1', immediately bypassing all application-layer rate limiting. The attacker iterates through a credential dictionary at network speed from a single IP without triggering account lockout or throttling, eventually authenticating as a target user. No public proof-of-concept code is confirmed, but the technique requires only standard HTTP tooling and knowledge of the bypass.