CVE-2026-86729: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-86729 Overview

CVE-2026-86729 is an authentication weakness in WWBN AVideo through commit e01e41ecc. The get_api_preauthorize function in plugin/API/API.php exposes an undocumented second login path that skips the rate limiting enforced on get_api_signIn. Attackers can perform unlimited remote password guessing against any account, including administrators. The same endpoint doubles as a credential oracle: the users_id field in the response reveals whether authentication succeeded, and a correct password issues a valid session cookie for subsequent authenticated API requests. No patched version is currently available.

Critical Impact
Unauthenticated attackers can brute-force arbitrary AVideo accounts, including admin, and obtain valid API session cookies.

Affected Products

WWBN AVideo through commit e01e41ecc
plugin/API/API.php — get_api_preauthorize endpoint
All AVideo deployments with API plugin enabled

Discovery Timeline

2026-09-08 - CVE-2026-86729 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86729

Vulnerability Analysis

The flaw is an Improper Restriction of Excessive Authentication Attempts [CWE-307]. WWBN AVideo exposes two login paths through its API plugin. The documented path, get_api_signIn, invokes checkRateLimit() and caps clients at 10 attempts per 5 minutes. The undocumented path, get_api_preauthorize, performs the same credential verification but omits the throttling call entirely. This asymmetry lets any unauthenticated client submit unlimited username and password combinations against arbitrary accounts over the network.

The endpoint compounds the issue by behaving as a credential oracle. Every response contains the string Invalid credentials, regardless of whether the supplied password is correct. Attackers instead read the users_id field to determine outcome: users_id:0 indicates failure and a non-zero identifier such as users_id:1 indicates successful authentication against the corresponding account. A successful call also establishes a session cookie that remains valid for subsequent authenticated API calls, converting the oracle directly into account takeover.

Root Cause

The root cause is missing invocation of checkRateLimit() inside get_api_preauthorize. The function reuses the shared credential validation logic but bypasses the anti-automation control applied to the primary sign-in path. The misleading error message combined with the disclosing users_id field further undermines the intended protection.

Attack Vector

Exploitation requires only network access to the AVideo API. An attacker scripts HTTP requests to plugin/API/API.php?APIName=preauthorize with candidate credentials, iterates through wordlists, and inspects the users_id field in each JSON response to identify valid combinations. Once a valid credential is found, the returned session cookie authorizes further API operations under that account.

Refer to the GitHub Security Advisory GHSA-vvqm-mgc5-hhx3 and the VulnCheck advisory for the full technical write-up.

Detection Methods for CVE-2026-86729

Indicators of Compromise

High-volume HTTP requests to plugin/API/API.php with APIName=preauthorize or similar parameters from a single source.
Repeated JSON responses containing Invalid credentials followed by a request returning a non-zero users_id value.
New authenticated API sessions from IP addresses that have not previously interacted with the application.
Unusual admin account activity, including profile changes or new API tokens, following bursts of preauthorize traffic.

Detection Strategies

Alert on any request path invoking get_api_preauthorize and correlate request counts per source IP over short time windows.
Baseline normal AVideo API usage and flag deviations in request rate, user-agent diversity, and geographic origin.
Inspect response bodies for users_id transitions from 0 to non-zero within the same client session, indicating a successful guess after failures.

Monitoring Recommendations

Forward AVideo web server access logs and application logs to a centralized analytics pipeline for correlation.
Track authentication outcomes per user and per source IP to identify slow, distributed brute-force attempts.
Monitor issuance of new session cookies tied to admin accounts and generate alerts on any first-time authenticated actions from new IP addresses.

How to Mitigate CVE-2026-86729

Immediate Actions Required

Restrict network exposure of the AVideo API using firewall or reverse-proxy allow lists until a fix is available.
Enforce rate limiting for requests to plugin/API/API.php at the web server or WAF layer, mirroring the 10-attempts-per-5-minutes limit applied to get_api_signIn.
Rotate credentials for admin and privileged accounts and invalidate existing API session cookies.
Review recent access logs for evidence of preauthorize abuse and successful unauthorized logins.

Patch Information

No patched version was available at the time of publication. Track the WWBN AVideo security advisory GHSA-vvqm-mgc5-hhx3 for a vendor fix and upgrade as soon as a corrected release is issued.

Workarounds

Block or return HTTP 403 for any request targeting the preauthorize API name at the reverse proxy.
Require multi-factor authentication on administrator accounts to reduce the impact of credential compromise.
Deploy a WAF rule that inspects response bodies and rate-limits clients that generate repeated authentication attempts against the API endpoint.

bash

# Example nginx rule to block the undocumented endpoint
location /plugin/API/API.php {
    if ($arg_APIName = "preauthorize") {
        return 403;
    }
    limit_req zone=avideo_login burst=10 nodelay;
}