CVE-2026-92583: AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential attempts to exceed the documented 30-attempts-per-5-minutes login limit by an arbitrary factor determined only by their connection concurrency.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs only network access to the affected AVideo instance and the ability to issue concurrent requests. No authentication or user interaction is required.
Are login protections affected?
Yes. The race condition can bypass login brute-force protection, allowing parallel credential attempts to exceed the documented limit of 30 attempts per five minutes. The amount by which the limit can be exceeded depends on the attacker's connection concurrency.
Which deployments should be considered exposed?
AVideo installations through version 29.0 should be considered exposed where an attacker can send concurrent requests to the application. The issue affects all rate limits enforced through the vulnerable counter update behavior.