CVE-2026-84476: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-84476 Overview

CVE-2026-84476 affects WWBN AVideo, an open-source video streaming platform. The application trusts the X-Real-IP and X-Forwarded-For HTTP headers without validating whether the request originates from a trusted proxy. The enforceRateLimit() function uses the spoofed client address for rate-limit tracking. Attackers can rotate header values on each request to bypass login rate limiting and perform unlimited credential guessing attacks against user accounts.

The issue is classified as [CWE-290: Authentication Bypass by Spoofing]. The vulnerability enables remote, unauthenticated exploitation over the network.

Critical Impact

Attackers can bypass login rate limiting by spoofing proxy headers, enabling unlimited brute-force credential attacks against AVideo user accounts, including administrators.

Affected Products

• WWBN AVideo (open-source video streaming platform)
• Versions prior to the fixed release referenced in GHSA-gg65-574p-h4wc
• Deployments not fronted by a properly configured trusted reverse proxy

Discovery Timeline

• 2026-09-01 - CVE-2026-84476 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84476

Vulnerability Analysis

AVideo's rate limiting relies on identifying each client by IP address. The enforceRateLimit() function pulls the client address from HTTP headers rather than the TCP-level source IP. Specifically, the application reads X-Real-IP and X-Forwarded-For headers as authoritative, without first confirming the request arrived from a whitelisted reverse proxy.

An attacker sending requests directly to the application server can set these headers to any value. The rate-limit counter keyed on the attacker-supplied address never accumulates because every login attempt uses a fresh, spoofed identifier. The lockout, throttle, and delay mechanisms that normally slow credential guessing become ineffective.

This defect converts a bounded authentication surface into an unbounded one. Weak passwords, reused credentials, and credential-stuffing lists can be tested at full request throughput against login endpoints.

Root Cause

The root cause is missing trusted-proxy validation before consuming forwarded-client headers. Web applications that sit behind a reverse proxy must define which upstream addresses are permitted to set X-Forwarded-For or X-Real-IP. AVideo omitted that check, treating any client as a proxy.

Attack Vector

Exploitation requires only network access to the AVideo login endpoint. An attacker issues repeated POST requests to the authentication handler while incrementing or randomizing the X-Real-IP or X-Forwarded-For header on each attempt. Each request appears to originate from a distinct source, so the rate limiter never triggers. The attacker iterates through username and password combinations until valid credentials are found. Refer to the VulnCheck Authentication Bypass Advisory for further technical detail.

Detection Methods for CVE-2026-84476

Indicators of Compromise

• High volume of authentication requests to AVideo login endpoints with rapidly changing X-Real-IP or X-Forwarded-For header values from a single TCP source.
• Successful logins immediately following bursts of failed attempts across many spoofed client IPs.
• Web-server access logs showing X-Forwarded-For values that do not correspond to any known upstream proxy or CDN range.

Detection Strategies

• Compare the TCP source IP of each request to the X-Forwarded-For header. Alert when a single TCP source rotates many distinct forwarded addresses.
• Instrument the AVideo authentication endpoint to log failed login attempts with both TCP source and header-provided IP, then correlate for volume anomalies.
• Deploy WAF or reverse-proxy rules that strip or overwrite X-Real-IP and X-Forwarded-For for requests arriving from untrusted networks.

Monitoring Recommendations

• Track authentication failure rates per real TCP source over short intervals and alert on spikes.
• Monitor for enumeration patterns targeting /user/login, /objects/userLogin.json.php, and related AVideo authentication paths.
• Aggregate reverse-proxy and application logs into a central SIEM to enable header-vs-source correlation queries.

How to Mitigate CVE-2026-84476

Immediate Actions Required

• Upgrade WWBN AVideo to the fixed release identified in GHSA-gg65-574p-h4wc.
• Place AVideo behind a reverse proxy configured to strip inbound X-Real-IP and X-Forwarded-For headers from external clients.
• Reset passwords for administrator and privileged accounts and review recent authentication logs for signs of successful brute-force compromise.

Patch Information

The maintainers have addressed the flaw so that enforceRateLimit() uses a client address derived from a validated proxy chain. Consult the GitHub Security Advisory GHSA-gg65-574p-h4wc for the exact fixed version and upgrade instructions.

Workarounds

• Configure the fronting reverse proxy (for example, Nginx or Apache) to unset X-Real-IP and X-Forwarded-For on requests received directly from the internet and set them only for its own upstream traffic.
• Enforce account lockout and multi-factor authentication at an identity provider or WAF layer so that credential guessing is throttled independently of the vulnerable application logic.
• Restrict access to AVideo administrative login paths using IP allowlists at the network edge until patching is complete.

# Nginx example: strip client-supplied forwarding headers and set trusted values
server {
    listen 443 ssl;
    server_name avideo.example.com;

    # Remove any client-supplied values before proxying
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;

    location / {
        proxy_pass http://avideo_backend;
    }
}