CVE-2026-84476: WWBN AVideo Authentication Bypass via X-Real-IP Header
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure WWBN AVideo validates trusted proxies before accepting the X-Real-IP and X-Forwarded-For headers; only honor client IP from these headers when the request originates from a configured trusted proxy.
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo instances that accept attacker-controlled X-Real-IP or X-Forwarded-For headers for client address determination are exposed. The issue is reachable remotely and does not require authentication or user interaction.
What does an attacker need to bypass the login rate limit?
An attacker can send login requests with spoofed X-Real-IP or X-Forwarded-For values and change the value on each request. This causes enforceRateLimit() to treat credential-guessing attempts as coming from different client addresses.
What is the practical impact?
The bypass permits unlimited credential guessing attempts against the login functionality despite rate limiting. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.
What can be changed if patching is not immediately possible?
Ensure AVideo only accepts client-IP forwarding headers from validated, trusted proxies, and prevent direct clients from supplying X-Real-IP or X-Forwarded-For values that influence rate limiting.