Executive brief
WWBN AVideo is a video hosting and streaming platform. An undocumented login endpoint (get_api_preauthorize) lacks the rate-limiting protections of the main login path, allowing attackers to make unlimited password guesses against any account, including admin accounts. The endpoint additionally discloses whether a password is correct through response fields, making automated account takeover practical and reliable without needing legitimate streaming permissions.
Technical details
The vulnerability is a brute-force attack enabled by missing rate limiting on an authentication endpoint (CWE-307). The get_api_preauthorize function in plugin/API/API.php accepts username and password credentials, verifies them against the same backend as the intended login endpoint (get_api_signIn), and establishes a valid authenticated session on success. Unlike get_api_signIn, which enforces a 10-attempts-per-5-minutes rate limit via checkRateLimit(), get_api_preauthorize contains no throttling mechanism whatsoever. Additionally, the endpoint functions as a credential oracle: it returns an identical "Invalid credentials" message for both correct and incorrect passwords, but the users_id field in the JSON response body discloses the result (users_id:1 on correct password, users_id:0 on incorrect), allowing reliable detection of valid credentials. An attacker with network access to the API endpoint can make unlimited password guesses from a single IP address without triggering defenses, and upon success obtains an authenticated session cookie usable for privileged API operations. No patched version is currently available.
Affected products
- WWBN AVideo through commit e01e41ecc (no patched version available)
Timeline
- 2026-09-08: disclosed: CVE-2026-86729 published on NVD and GitHub Security Advisory GHSA-vvqm-mgc5-hhx3 published