Executive brief
AVideo is a video hosting and streaming platform. A race condition in its rate-limiting function allows attackers to bypass all rate limits—including login brute-force protection—by submitting concurrent requests. This enables attackers to attempt far more login guesses than the documented 30 attempts per 5 minutes, dramatically increasing the risk of account compromise.
Technical details
The vulnerability is a race condition (CWE-307) in the enforceRateLimit() function (objects/functionsSecurity.php:822-842), which implements a non-atomic read-modify-write operation on rate limit counters. The function reads a counter from file-based cache, compares it against a limit, and writes back an incremented value—all without synchronization or atomic operations. Concurrent PHP workers all read the same value before any write, causing increments to be lost; an attacker can exceed limits by an arbitrary factor depending only on request concurrency. The login endpoint specifically calls enforceRateLimit('login', 30, 300), and no other brute-force control exists. A proof of concept demonstrated 57 of 60 concurrent login attempts succeeding where sequential requests correctly enforced the limit. The fix requires atomic increment operations, either via memcached::increment(), database-backed counters with UPDATE…ON DUPLICATE KEY, or file-system locking.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-09-01: disclosed
- 2026-09-16: advisory: NVD and VulnCheck advisories published