10 matches found
EUVD-2026-81283
AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...
CVE-2026-92583
AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...
CVE-2026-92583 AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment
AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...
CVE-2026-92583 AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment
AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...
CVE-2026-92583
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters. An unauthenticated remote attacker can bypass all rate limits , including the documented 30-attempts-per-5-minutes login brute-force protection , by issuing con...
CVE-2026-92583 AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment
AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...
CVE-2026-92583: Improper Restriction of Excessive Authentication Attempts
AVideo through 29.0 contains a race condition in the enforceRateLimit function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential...
PT-2026-94100
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description A race condition exists in the enforceRateLimit function that fails to atomically increment rate limit counters. This allows attackers to bypass all rate limits, including login brute-force protection,...
CVE-2026-84476: Authentication Bypass by Spoofing
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit. Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing...
CVE-2026-82644: Improper Restriction of Excessive Authentication Attempts
WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...