Executive brief
WWBN AVideo is a video streaming and hosting platform. This vulnerability allows an attacker to bypass login rate limiting by spoofing client IP addresses through HTTP headers, enabling unlimited credential guessing attacks and account takeover.
Technical details
The vulnerability exists in the getRealIpAddr() function, which accepts client-supplied X-Real-IP and X-Forwarded-For headers without validating whether the request comes from a trusted proxy. When REMOTE_ADDR is private (as in containerized or reverse-proxy deployments), the function returns the attacker-controlled header value. The enforceRateLimit() function uses this spoofed address as its rate-limit key, allowing attackers to rotate the header per request and bypass the 30-login-attempt limit. The attack requires network access to the login endpoint; no authentication is required. PoC testing confirmed 45 consecutive failed logins succeeded with header rotation vs. 30 before rate-limiting kicked in without the header.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-18: disclosed: GitHub Security Advisory published
- 2026-09-01: advisory: CVE-2026-84476 published on NVD