Executive brief
WWBN AVideo is a video hosting and streaming platform. The application's login protection mechanism can be bypassed by omitting the User-Agent header or using certain bot-like identifiers, allowing attackers to perform unlimited password-guessing attacks without triggering rate limits. This enables account takeover and unauthorized access to user accounts.
Technical details
The vulnerability is a rate-limiting bypass (CWE-307: Improper Restriction of Excessive Authentication Attempts) in the enforceRateLimit() function, which protects 14 endpoints including login.json.php. The function stores attempt counters via a cache layer (ObjectYPT::setCacheGlobal) that silently discards writes for any request identified as bot-like by isBot(). Since isBot() treats a missing User-Agent header as a bot by default—and also flags requests with common bot identifiers like 'curl', 'bot', 'crawler', and 'spider'—the counter never increments, causing the rate limit to never trigger. An unauthenticated attacker can send unlimited login requests by omitting the User-Agent header or using curl's default User-Agent, bypassing all rate-limiting protection and enabling unrestricted password-guessing attacks. Proof-of-concept testing confirmed that 45 consecutive failed login attempts with no User-Agent header all succeeded (HTTP 200), while the same attempts with a normal browser User-Agent are blocked after 30 attempts (HTTP 429). No patch has been announced as of the advisory date.
Affected products
- WWBN AVideo current (e01e41ecc) and earlier
Timeline
- 2026-08-30: disclosed
- 2026-08-14: advisory: GitHub Security Advisory GHSA-6893-mcgv-9p2x published