CVE-2026-82643: Improper Restriction of Excessive Authentication Attempts in WWBN AVideo

WWBN AVideo contains an unauthenticated credential submission vulnerability in the plugin Live/api/preauthorize.json.php endpoint. The endpoint accepts credentials over GET requests without implementing rate limiting controls. This flaw allows attackers to submit correct credentials repeatedly, which can trigger uncapped two-factor authentication confirmation emails and facilitate sustained password guessing attacks against user accounts. No patch or official remediation guidance is currently documented.

Attackers can perform repeated authentication attempts without restriction, potentially leading to denial of service via flooding users with two-factor authentication emails and increasing the risk of successful password guessing attacks. This undermines account security and user experience by enabling abuse of the authentication mechanism.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting on the affected endpoint or monitoring for unusual authentication request patterns to reduce abuse.