CVE-2026-84479: WWBN AVideo Authentication Bypass via User-Agent Header
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTPUSERAGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs valid AVideo credentials. They can then send a login request with the User-Agent header set to AVideoEncoder, which is sufficient to trigger the affected trust checks; no special network position, shared secret, or user interaction is described.
Are deployments protected by two-factor authentication still affected?
Yes. A login using the AVideoEncoder User-Agent value bypasses two-factor authentication. The same header also skips brute-force CAPTCHA escalation and prevents the login from being recorded in login/device audit history.
What can be done if patching is not possible?
No patch is available at the time of publication. The provided information does not identify a confirmed workaround; defenders should treat User-Agent values associated with AVideoEncoder and AVideoMobileApp as untrusted and investigate authentication controls and logs with the understanding that affected logins may not appear in the login/device audit history.