CVE-2026-86186: AVideo API Rate Limit Bypass via Bot User-Agent Header
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing attempts against any account from a single IP address.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker only needs network access to the affected API and can send requests with a bot User-Agent header. No authentication or user interaction is required.
Which activity is most directly exposed?
Login brute-force protection is among the eight rate-limited operations that can be bypassed. An attacker can make unlimited password-guessing attempts against any account from a single IP address.
Are rate limits still effective for clients that identify as bots?
No. Sending a bot User-Agent header disables rate-limit enforcement for all eight protected API operations.