WWBN AVideo CVE-2026-86729

Exploitation requires network reachability to the AVideo API and use of the undocumented get_api_preauthorize action, which by design skips the checkRateLimit() throttle that protects get_api_signIn - no authentication, user interaction, or non-default configuration is needed to reach it. The limiting factor is password strength: success is a probabilistic brute-force (reflected as AT:P), so accounts with strong, high-entropy passwords or external lockout controls substantially reduce real-world exploitability, while the users_id credential oracle removes any guesswork about when a guess succeeds.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N, score 9.1) reflects a network-reachable, unauthenticated flaw with high confidentiality and integrity impact via account takeover; the AT:P (attack requirements present) acknowledges that brute-force success is probabilistic and depends on password strength, which realistically tempers exploitability against accounts with strong credentials. No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active or automated exploitation yet. Real-world priority is genuine because the barrier is only 'undocumented endpoint + weak/guessable password' and the target is admin-capable accounts, but the practical difficulty scales with password entropy and lockout compensations. The absence of any patched version raises urgency for exposed deployments; conversely the low EPSS/KEV signal suggests this is not yet mass-exploited.

A remote attacker discovers the undocumented get_api_preauthorize endpoint and scripts high-rate password guesses against the admin account, using the returned users_id value (1 vs 0) to confirm exactly when a guess is correct despite the constant 'Invalid credentials' message. On a hit, the endpoint returns a valid session cookie, and the attacker replays it to make authenticated API calls with full admin capabilities. No POC is published, but the attack requires only standard HTTP tooling.