CVE-2026-84479: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-84479 Overview

CVE-2026-84479 is an authentication bypass vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw affects commit e01e41ecc and earlier releases. Three login-time security controls rely solely on the client-supplied User-Agent HTTP header for trust decisions. An attacker who submits valid credentials with User-Agent: AVideoEncoder bypasses two-factor authentication (2FA), skips brute-force captcha escalation, and evades the login and device audit history. The weakness is classified as [CWE-290] Authentication Bypass by Spoofing. No vendor patch is available at the time of publication.

Critical Impact
Attackers with valid or brute-forced credentials can bypass 2FA and defeat brute-force protections while remaining invisible to login auditing.

Affected Products

WWBN AVideo at commit e01e41ecc
All WWBN AVideo releases prior to commit e01e41ecc
Deployments exposing the AVideo login endpoint to untrusted networks

Discovery Timeline

2026-09-01 - CVE-2026-84479 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84479

Vulnerability Analysis

WWBN AVideo exposes helper functions isAVideoEncoder() and isAVideoMobileApp() that gate multiple login-time security controls. Each function compares the incoming HTTP_USER_AGENT value against a hardcoded literal string (AVideoEncoder or AVideoMobileApp). No source IP restriction, mutual TLS, HMAC signature, or shared secret validates the caller. Any HTTP client can set the header to a matching value.

When the User-Agent match succeeds, three protections are disabled during authentication. Two-factor authentication is skipped entirely, captcha escalation after failed login attempts is suppressed, and the successful login is omitted from the login and device audit history. An attacker who obtains valid credentials through phishing, credential stuffing, or reuse can log in as any user without triggering the 2FA challenge, without being throttled by captcha, and without leaving a record in the audit trail visible to the account owner or administrators.

Root Cause

The root cause is treating a client-controlled request header as an authentication signal. HTTP User-Agent values are attacker-mutable and carry no cryptographic proof of origin. Using them for authorization decisions violates the principle that trust must derive from a verifiable secret or channel.

Attack Vector

Exploitation requires only network access to the AVideo login endpoint and valid credentials for a target account. The attacker sends a standard login POST request with the User-Agent header set to AVideoEncoder. The server treats the session as originating from a trusted encoder client and completes authentication without invoking 2FA, captcha escalation, or audit logging. Refer to the GitHub Security Advisory GHSA-m9m3-gwh2-337c and the VulnCheck Authentication Bypass Advisory for additional technical detail.

Detection Methods for CVE-2026-84479

Indicators of Compromise

Login events from unexpected client IP addresses carrying User-Agent: AVideoEncoder or User-Agent: AVideoMobileApp.
Successful account logins that lack corresponding entries in the AVideo login and device audit history.
User accounts with 2FA enabled that show no 2FA challenge events preceding a successful session.
Spikes in failed login attempts against a user that never trigger captcha escalation.

Detection Strategies

Inspect web server or reverse proxy access logs for requests to authentication endpoints where the User-Agent equals the hardcoded encoder or mobile app literals.
Correlate application-level audit history with web-tier authentication requests to surface successful logins missing from the audit table.
Alert on authentication requests where the request path corresponds to login and the User-Agent matches encoder or mobile app strings from source IPs outside the known encoder or mobile infrastructure.

Monitoring Recommendations

Enable verbose access logging on the web server fronting AVideo and forward it to a centralized log store for retention and searchability.
Baseline the source IP ranges legitimately used by AVideo encoders and mobile clients, then alert on deviations.
Monitor for authenticated session creation events without preceding 2FA verification for accounts that have 2FA enrolled.

How to Mitigate CVE-2026-84479

Immediate Actions Required

Restrict access to the AVideo login endpoint at the network edge to trusted IP ranges until a patch is released.
Enforce strong, unique passwords and rotate credentials for privileged AVideo accounts to reduce the value of credential theft.
Deploy a Web Application Firewall (WAF) rule that blocks or challenges authentication requests bearing User-Agent: AVideoEncoder or User-Agent: AVideoMobileApp from unexpected sources.
Review recent authentication activity for successful logins missing corresponding audit history entries.

Patch Information

No vendor patch is available at the time of publication. Track the WWBN AVideo GitHub Security Advisory GHSA-m9m3-gwh2-337c for remediation updates. When a fix is released, upgrade all AVideo instances and audit the login helpers to confirm the User-Agent match is supplemented with an IP allowlist or shared secret.

Workarounds

Terminate TLS at a reverse proxy and strip or normalize incoming User-Agent headers matching the trusted literals before forwarding requests to AVideo.
Enforce mutual TLS or an IP allowlist for legitimate encoder and mobile app clients so unauthenticated hosts cannot reach the login endpoint.
Disable the encoder and mobile app fast-path helpers by editing isAVideoEncoder() and isAVideoMobileApp() to always return false if encoder and mobile integrations are not in use.

bash

# Example NGINX rule to block spoofed User-Agent values on the login endpoint
location /objects/userLogin.json.php {
    if ($http_user_agent ~* "^(AVideoEncoder|AVideoMobileApp)$") {
        return 403;
    }
    proxy_pass http://avideo_backend;
}