CVE-2026-84479

Received Received - Intake

Authentication Bypass in AVideo via User-Agent Spoofing

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84479

EUVD

EUVD-2026-69721

Affected Vendors & Products

Vendor	Product	Version / Range
wwbn	avideo	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

WWBN AVideo versions up to e01e41ecc have a security flaw where login-time controls rely only on the User-Agent header. The checks for AVideoEncoder and AVideoMobileApp match this header against hardcoded values without verifying IP addresses or shared secrets. Attackers can bypass two-factor authentication, skip captcha escalation, and avoid audit logging by setting the User-Agent header to AVideoEncoder.

Detection Guidance

Check HTTP request logs for User-Agent headers set to 'AVideoEncoder' or 'AVideoMobileApp' during login attempts. Monitor for successful logins without corresponding device audit entries or CAPTCHA challenges.

Impact Analysis

This vulnerability allows attackers to bypass authentication controls, gain unauthorized access to accounts, and avoid detection in audit logs. It could lead to data breaches, unauthorized actions, and compromised user accounts if exploited.

Compliance Impact

This vulnerability could violate compliance requirements for data protection and access controls. It may lead to unauthorized access to sensitive data, undermining GDPR's integrity and confidentiality principles and HIPAA's safeguards for protected health information.

Mitigation Strategies

Disable or restrict access to the login endpoint until a patch is available. Implement server-side checks for valid User-Agent usage instead of relying solely on client headers. Monitor for suspicious login patterns.

Hi! I’m here to help you understand CVE-2026-84479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70