WWBN AVideo EUVD-2026-69718

No special conditions required beyond network access to the AVideo login endpoint. The vulnerability is present in any AVideo deployment where the application receives and trusts X-Real-IP or X-Forwarded-For headers from clients, which is the default application behaviour. Deployments behind a correctly configured reverse proxy that strips client-supplied forwarding headers before passing requests to AVideo are not exploitable via this path, but this is a non-default infrastructure hardening step that is not guaranteed. No authentication is needed; the attacker targets the unauthenticated login flow. The immediate effect is rate-limit bypass enabling unlimited login attempts - successful account compromise additionally requires a guessable or previously leaked credential, meaning strong unique passwords and MFA directly limit the downstream impact.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects trivially automated exploitation with no authentication or special prerequisites. The practical risk is credential exposure rather than direct data exfiltration from the vulnerability itself: a successful brute-force campaign converts this bypass into full account takeover for any account using a weak or previously leaked password. No CISA KEV listing or public proof-of-concept code has been identified at time of analysis, and EPSS data was not supplied, so exploitation prevalence is currently unconfirmed. However, the attack requires only standard HTTP tooling, no vulnerability-specific knowledge, and is easily automated at scale, meaning the effective exploitation barrier is low despite the absence of a known active campaign. Deployments behind a reverse proxy that explicitly strips or rewrites client-supplied forwarding headers before reaching AVideo are not exposed via this path, but this is an infrastructure hardening step independent of the application and not guaranteed in default deployments. The CVSS 4.0 vector's VC:H/VI:N accurately captures the primary impact path - confidentiality loss through account compromise - while the lack of a direct integrity or availability effect from the bypass mechanism itself is correctly reflected.

An unauthenticated attacker sends a series of POST requests to AVideo's login endpoint, incrementing the X-Real-IP header value with each attempt (e.g., cycling through synthetic addresses such as 10.0.0.1, 10.0.0.2, and so on) so that enforceRateLimit() treats each attempt as originating from a distinct client. With throttling effectively disabled, the attacker replays a large credential-stuffing or dictionary list against a target account, eventually matching valid credentials and gaining authenticated session access. No exploit code beyond standard HTTP scripting tools is required.