CVE-2026-82644
Received Received - Intake

Brute Force Rate Limiting Bypass in WWBN AVideo

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulnCheck

Description
WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that silently discards writes for any client identified as a bot by isBot(). Because isBot() treats a missing User-Agent header as a bot by default — and also matches common bot identifiers such as 'curl', 'bot', 'crawler', and 'spider' — the counter never increments for such clients, so the rate limit never fires. An unauthenticated attacker can therefore submit unlimited login attempts (e.g., by omitting the User-Agent header or using curl's default User-Agent), enabling unrestricted password-guessing attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82644
EUVD
EUVD-2026-68230

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to e01e41ecc (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82644 is a brute-force rate limiting bypass in WWBN AVideo (versions up to e01e41ecc). The vulnerability occurs in the enforceRateLimit() function, which protects 14 endpoints including login.json.php. The function uses a cache layer to track login attempts, but this counter fails to increment for clients identified as bots by isBot(). Since isBot() treats missing User-Agent headers or common bot identifiers (e.g., curl, bot) as bots, the rate limit is never triggered. This allows unlimited password-guessing attempts without detection.

Detection Guidance

To detect this vulnerability, monitor login attempts to login.json.php and other protected endpoints. Check for repeated failed login attempts with missing or bot-like User-Agent headers (e.g., curl, bot, crawler). Use network logs to identify clients bypassing rate limits by omitting User-Agent headers.

Impact Analysis

An unauthenticated attacker can bypass rate limiting by omitting the User-Agent header or using default curl User-Agents. This enables unrestricted password-guessing attacks, potentially leading to unauthorized account access. The vulnerability affects login attempts and other endpoints like captcha generation and view-count submission.

Compliance Impact

This vulnerability could lead to unauthorized access through brute-force attacks, potentially violating data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for electronic protected health information). Unrestricted login attempts may expose sensitive user data, triggering compliance violations if proper access controls are not enforced.

Mitigation Strategies

Immediately update AVideo to the latest patched version. Temporarily enforce stricter rate limiting by disabling bot checks for login attempts. Monitor login endpoints for unusual activity and block suspicious IPs. Consider disabling login.json.php if not essential.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82644. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart