CVE-2026-84476: Authentication Bypass by Spoofing in WWBN AVideo

The vulnerability in WWBN AVideo arises from the application's failure to validate trusted proxy headers before using X-Real-IP and X-Forwarded-For values in the enforceRateLimit() function. This allows an attacker to spoof the client IP address, circumventing login rate limiting mechanisms designed to prevent brute force attacks. By rotating spoofed header values, attackers can perform unlimited credential guessing without triggering rate limits.

Successful exploitation allows attackers to bypass login rate limiting protections, increasing the risk of credential guessing attacks. This can lead to unauthorized access if valid credentials are guessed, potentially compromising user accounts and the application environment. There is no indication of privilege escalation or other impacts beyond authentication bypass via rate limit evasion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing additional protections such as validating trusted proxy headers at the network or application firewall level or disabling reliance on these headers for rate limiting. Monitoring for unusual login attempts may help detect exploitation attempts.