WWBN AVideo contains an undocumented login API endpoint get_api_preauthorize that performs credential checks without any rate limiting, unlike the documented get_api_signIn endpoint which enforces a limit of 10 attempts per 5 minutes. This lack of throttling allows attackers to perform unlimited password guessing attempts remotely. Additionally, the endpoint reveals whether a password is correct or not through the users_id field in the response, acting as a credential oracle. A successful login via this endpoint establishes a session cookie usable for authenticated API requests. These combined issues enable unauthenticated attackers to brute-force and take over arbitrary user accounts, including admin accounts.

The vulnerability allows unauthenticated remote attackers to perform unlimited password guessing attempts against any user account, bypassing rate limiting controls. This can lead to account takeover, including administrative accounts, compromising the confidentiality and integrity of the affected system. The disclosure of authentication status via the users_id field further aids attackers in verifying valid credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to monitor for unusual authentication attempts and consider implementing external rate limiting or blocking on the affected endpoint if possible.