Executive brief
AVideo is a video hosting and sharing platform with API endpoints that implement rate limiting to protect against brute-force attacks and resource exhaustion. Attackers can completely disable rate limiting on all protected operations—including login password guessing and video password attempts—by simply sending a bot User-Agent header in their requests. This allows unlimited credential guessing attacks from a single IP address, compromising account security across the platform.
Technical details
The vulnerability is a protection mechanism failure in the AVideo API's rate-limit enforcement layer. The checkRateLimit() function in plugin/API/API.php stores attempt counters in a shared object cache but relies on ObjectYPT::setCache(), which intentionally refuses to cache data for requests bearing bot User-Agent headers. While the read operation still occurs (returning zero), the counter increment never executes for bot clients, leaving the limiter permanently at zero attempts. This affects eight protected operations including sign_in (10 attempts per 5 minutes), video_password_check, user_registration, login_code operations, and resource-intensive endpoints. The attack requires only a single HTTP request header modification (e.g., User-Agent: Googlebot/2.1) and no authentication. The vendor has committed a patch using a forced-write path (setCacheGlobalForce) that bypasses the bot-detection guard for security counters.
Affected products
- WWBN AVideo <= 29.0
Timeline
- 2026-08-21: disclosed: GitHub Security Advisory GHSA-qmmw-hmm4-xxp7 published
- 2026-09-05: advisory: CVE-2026-86186 published