CVE-2026-82644: Improper Restriction of Excessive Authentication Attempts in WWBN AVideo

CVE-2026-82644 describes a brute-force rate limiting bypass in WWBN AVideo's enforceRateLimit() function, which protects login.json.php and 13 other endpoints. The function uses a cache layer to track authentication attempts but silently discards writes for clients identified as bots by the isBot() function. Since isBot() treats missing User-Agent headers and common bot strings (e.g., 'curl', 'bot', 'crawler', 'spider') as bots, the attempt counter never increments for such clients. Consequently, the rate limit never triggers, allowing unauthenticated attackers to perform unlimited login attempts and password guessing attacks.

An unauthenticated attacker can bypass the brute-force rate limiting protections by omitting or manipulating the User-Agent header to appear as a bot. This allows unlimited login attempts against the affected endpoints, increasing the risk of successful password guessing and unauthorized access. The vulnerability affects authentication security but does not indicate direct code execution or data exposure beyond authentication bypass.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional protections such as stricter rate limiting that does not rely on User-Agent headers or bot detection, and monitoring for unusual login attempt patterns. Avoid relying solely on User-Agent-based bot detection for security controls.