CVE-2026-84479: Authentication Bypass by Spoofing in WWBN AVideo

WWBN AVideo (current e01e41ecc and earlier) improperly trusts the User-Agent HTTP header to enforce three critical login-time security controls: two-factor authentication enforcement, brute-force captcha escalation, and login/device audit logging. The checks isAVideoEncoder() and isAVideoMobileApp() match the HTTP_USER_AGENT header against hardcoded literals without additional verification such as IP checks or shared secrets. This allows an attacker who submits valid credentials and spoofs the User-Agent header as "AVideoEncoder" to bypass these security mechanisms, effectively circumventing multi-factor authentication and audit trails.

An attacker with valid credentials can bypass two-factor authentication, avoid brute-force captcha escalation, and prevent their login activity from being recorded in audit logs. This significantly reduces the security protections around authentication, increasing the risk of unauthorized access and undetected compromise.

No patch or official fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider implementing additional network-level controls or monitoring to detect suspicious login behavior. Avoid relying on client-supplied User-Agent headers for security decisions.