CVE-2026-86729: Improper Restriction of Excessive Authentication Attempts in WWBN AVideo

WWBN AVideo versions 0 through 29.0 contain a vulnerability in the plugin/API/API.php file where the get_api_preauthorize endpoint serves as a second, undocumented login path. Unlike the get_api_signIn endpoint, which limits authentication attempts to 10 per 5 minutes, get_api_preauthorize does not implement any rate limiting, allowing unlimited authentication attempts. The endpoint also acts as a credential oracle by returning "Invalid credentials" messages for both correct and incorrect passwords and disclosing the users_id field in the response, which reveals the authenticated user's identity. A successful authentication via this endpoint establishes a session cookie usable for authenticated API requests. These combined issues permit unauthenticated attackers to perform brute-force password guessing and potentially take over arbitrary user accounts, including administrative ones.

The vulnerability allows unauthenticated attackers to perform unlimited password guessing attempts against any user account, including administrators, without triggering rate limits. The endpoint's response behavior leaks user identity information and confirms authentication success, facilitating credential validation. Successful exploitation results in account takeover and unauthorized access to the API with the privileges of the compromised account.

No patch or official fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restricting network access to the API endpoint or implementing external rate limiting and monitoring may reduce risk. Avoid exposing the vulnerable API publicly if possible.