AVideo versions up to and including 29.0 contain a race condition in the enforceRateLimit() function. This race condition prevents atomic incrementing of rate limit counters, allowing attackers to bypass all rate limits, including the login brute-force protection. By issuing concurrent requests, attackers can submit multiple credential attempts in parallel, exceeding the documented 30 attempts per 5 minutes limit by an arbitrary factor determined by their connection concurrency.

Attackers can bypass the login rate limiting mechanism, allowing them to perform brute-force attacks on user credentials at a much higher rate than intended. This increases the risk of unauthorized access through credential guessing or password spraying attacks. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external rate limiting controls or network-level protections to limit concurrent login attempts. Monitor for unusual authentication activity patterns indicative of brute-force attempts.