H3-2026-1099¶
AVideo Rate Limit Bypass via Bot User Agent Classification
| Category | SECURITY_CONTROLS |
| Base Score | 7.5 |
Description¶
WWBN AVideo's enforceRateLimit function relies on ObjectYPT cache helpers that skip caching entirely for requests classified as bots, including requests sent with an empty or curl User-Agent header. Because the login rate limit counter is stored in this same cache, bot classified clients are never counted and the limiter never trips for them. Remote attackers can send an empty User-Agent header on every login attempt to the objects/login.json.php endpoint and perform unlimited password guesses against any account, including the administrator. The condition requires only network access to the login endpoint and no prior authentication.
Impact¶
Unlimited brute force attempts let attackers eventually guess weak or default administrator passwords. A successful guess grants full administrative control over the AVideo platform and its hosted media content. The exposure applies to every account on the instance for as long as the bypass remains unpatched. Public facing AVideo deployments with weak passwords face the highest risk of full compromise.