CVE-2023-49810: WWBN AVideo · Improper Restriction of Excessive Authentication Attempts
Affects WWBN AVideoSource CVE Database V5
Not known to be exploited · CVSS 7.3 High.
Data as of 26 Oct 2026, 12:29 UTC
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 51% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 10 Jan 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Monitor WWBN's official channels for patches addressing CVE-2023-49810 and apply them immediately upon release.
- In the interim, implement additional rate-limiting controls at the web server or application firewall level to restrict the number of login attempts per IP address or user account.
- Deploy multi-factor authentication (MFA) to add an extra layer of security beyond passwords.
- Enhance logging and monitoring of login attempts to detect unusual patterns indicative of brute force attacks.
- Consider deploying web application firewalls (WAFs) with custom rules to detect and block requests attempting to bypass CAPTCHA mechanisms.
- Educate users about strong password practices and encourage regular password updates.
- Conduct regular security assessments and penetration tests focusing on authentication mechanisms.
- If feasible, isolate or restrict access to AVideo administrative interfaces to trusted networks or VPNs to reduce exposure.
Description
A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.