CVE-2026-82643: WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php
WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustained password guessing attacks against user accounts.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WWBN AVideo deployments where the Live plugin endpoint plugin/Live/api/preauthorize.json.php is reachable are exposed. No authentication or user interaction is required to submit requests to the affected endpoint.
What does an attacker need to exploit it?
An attacker needs network access to the endpoint and can submit credential attempts over GET requests. Successful abuse requires correct credentials to trigger two-factor confirmation emails, while the missing rate limit permits sustained password-guessing attempts.
What can happen if the endpoint is abused?
An attacker can generate uncapped two-factor confirmation emails for accounts with valid credentials and conduct sustained password guessing against user accounts. The reported impact includes integrity and availability effects, with no confidentiality impact listed.