CVE-2026-82644: WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent
WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that silently discards writes for any client identified as a bot by isBot(). Because isBot() treats a missing User-Agent header as a bot by default — and also matches common bot identifiers such as 'curl', 'bot', 'crawler', and 'spider' — the counter never increments for such clients, so the rate limit never fires. An unauthenticated attacker can therefore submit unlimited login attempts (e.g., by omitting the User-Agent header or using curl's default User-Agent), enabling unrestricted password-guessing attacks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
WWBN AVideo deployments at current commit e01e41ecc and earlier are affected where the protected endpoints, including login.json.php, are reachable by an attacker. The bypass applies because requests with no User-Agent, or User-Agent values identified as bots such as curl, bot, crawler, or spider, do not have attempts recorded.
What does an attacker need to exploit the issue?
No authentication, user interaction, or special access is required. An attacker can submit repeated login attempts while omitting the User-Agent header or using curl's default User-Agent, preventing the rate-limit counter from increasing.
How can administrators determine whether rate limiting is being bypassed?
Review login and protected-endpoint requests for missing User-Agent headers or bot-like User-Agent values, especially curl, bot, crawler, and spider. Repeated failed attempts from those clients without the expected rate-limit response indicate that the counter writes may be being discarded.