CVE-2026-92583: AVideo Race Condition Vulnerability

CVE-2026-92583 Overview

CVE-2026-92583 is a race condition vulnerability in AVideo through version 29.0. The flaw resides in the enforceRateLimit() function, which fails to atomically increment rate limit counters. Attackers can issue concurrent requests to bypass all rate limits enforced by the application, including login brute-force protection. The documented limit of 30 login attempts per 5 minutes can be exceeded by an arbitrary factor determined only by the attacker's connection concurrency. The vulnerability is classified as [CWE-307] Improper Restriction of Excessive Authentication Attempts.

Critical Impact
Attackers can bypass rate limits by submitting parallel requests, enabling large-scale credential brute-force attacks against AVideo login endpoints.

Affected Products

AVideo (WWBN) through version 29.0
All deployments relying on enforceRateLimit() for brute-force protection
AVideo login and authentication endpoints

Discovery Timeline

2026-09-16 - CVE-2026-92583 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92583

Vulnerability Analysis

AVideo enforces per-client rate limits using a counter maintained by the enforceRateLimit() function. The function reads the current counter, evaluates it against the configured threshold, and then increments the value. Because the read-check-increment sequence is not performed atomically, multiple concurrent requests can each observe the counter below the threshold before any of them update it. All parallel requests then pass the check, and the counter is incremented only after the decision has been made. This defeats the purpose of the rate limit for any attacker who can issue requests in parallel.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) atomicity violation. The counter increment is not protected by a lock, transaction, or atomic database operation. As a result, the check-then-update logic behaves correctly only under strictly serial traffic. Under concurrent access, multiple threads read the same value simultaneously and each decides that additional attempts are still permitted.

Attack Vector

Exploitation requires only network access to a login or other rate-limited endpoint. An attacker opens many concurrent HTTP connections and submits credential attempts in parallel. Instead of being capped at 30 attempts per 5 minutes, the effective attempt rate scales with the number of parallel connections the attacker can maintain. This enables high-volume password guessing, credential stuffing, and abuse of any other action the rate limiter was intended to protect.

No verified proof-of-concept code is available. See the GitHub Security Advisory GHSA-8jrm-qg5f-966w and the VulnCheck AVideo Rate Limit Bypass Advisory for additional technical details.

Detection Methods for CVE-2026-92583

Indicators of Compromise

Bursts of concurrent authentication requests from a single source IP or narrow IP range within very short time windows.
Login attempt volumes that exceed the documented 30-per-5-minutes limit against a single account or across many accounts.
Successful logins immediately following high-volume failed authentication attempts, indicating possible credential stuffing success.

Detection Strategies

Correlate web server access logs for parallel POST requests to AVideo authentication endpoints originating from the same client.
Alert on any account or client IP that produces more than the configured rate limit threshold within the enforcement window.
Deploy a web application firewall (WAF) rule to identify concurrent request patterns targeting /objects/user.json.php and other authentication paths.

Monitoring Recommendations

Enable detailed authentication logging in AVideo and forward events to a centralized SIEM for correlation.
Track the ratio of failed to successful logins per source IP and per account over rolling time windows.
Monitor for anomalous spikes in HTTP concurrency toward AVideo endpoints, especially outside normal user behavior baselines.

How to Mitigate CVE-2026-92583

Immediate Actions Required

Inventory all AVideo installations and identify instances running version 29.0 or earlier.
Restrict access to AVideo administrative and login endpoints to trusted networks where feasible.
Place AVideo behind a reverse proxy or WAF that enforces concurrency limits and per-IP request caps independent of the application.

Patch Information

At the time of publication, refer to the GitHub Security Advisory GHSA-8jrm-qg5f-966w for the latest patch status and remediation guidance from the AVideo maintainers. A permanent fix requires making the counter increment atomic, for example by using database-level atomic operations, row locking, or a transactional update in enforceRateLimit().

Workarounds

Enforce authentication rate limits at the reverse proxy or WAF layer using atomic counters or token buckets.
Require multi-factor authentication (MFA) for AVideo user accounts to reduce the impact of successful credential guessing.
Implement account lockout policies that trigger on absolute failed-attempt counts rather than time-windowed rate limits alone.
Deploy CAPTCHA or proof-of-work challenges on login endpoints to raise the cost of high-concurrency automated attacks.

bash

# Example NGINX configuration limiting concurrent login requests per client IP
limit_req_zone $binary_remote_addr zone=avideo_login:10m rate=6r/m;
limit_conn_zone $binary_remote_addr zone=avideo_conn:10m;

server {
    location /objects/user.json.php {
        limit_req zone=avideo_login burst=5 nodelay;
        limit_conn avideo_conn 2;
        proxy_pass http://avideo_backend;
    }
}