CVE-2026-86186: Improper Restriction of Excessive Authentication Attempts in WWBN AVideo
Description
CVE-2026-86186 is a vulnerability in WWBN AVideo where the API does not enforce rate limits for clients using a bot User-Agent header. This allows attackers to bypass protections on eight critical operations, including login brute-force defenses, enabling unlimited password guessing attempts from a single IP address. The vulnerability affects versions from 0 up to and including 29.0. The CVSS 4.0 score is 6.3, indicating a medium severity.
CVSS v4.0
Score 6.3medium
Affected software
WWBN
AVideo
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The AVideo API improperly restricts excessive authentication attempts by failing to apply rate limiting when requests include a bot User-Agent header. This flaw allows attackers to circumvent brute-force protections on eight protected operations, including login attempts, effectively enabling unlimited password guessing from a single IP address. The vulnerability affects all versions from 0 through 29.0 inclusive. No patch or remediation details are provided in the input data.
Potential Impact
Attackers can bypass rate limiting controls by sending requests with a bot User-Agent header, allowing unlimited password guessing attempts against any account from a single IP address. This increases the risk of account compromise through brute-force attacks. The vulnerability affects multiple critical operations, including login, which could lead to unauthorized access if exploited.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or monitoring for abnormal authentication attempts with bot User-Agent headers as a temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-05T11:51:31.101Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9c0d20acd9273b49d9712f
Added to database: 09/05/2026, 12:37:52 UTC
Last enriched: 09/15/2026, 00:56:32 UTC
Last updated: 10/19/2026, 18:48:24 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.