CVE-2026-86186

AVideo is a video hosting platform whose API rate-limiting mechanism fails to account for requests carrying a bot User-Agent header . This allows an unauthenticated attacker to bypass all eight protected operations , including login brute-force protection , by simply setting a bot User-Agent stri...