WWBN AVideo is vulnerable to a critical rate limiting bypass that allows unauthenticated attackers to conduct unlimited brute-force login attempts against the platform.

The application utilizes a flawed rate limiting mechanism in the enforceRateLimit function that fails to increment attempt counters for clients identified as bots. Because the isBot function incorrectly classifies requests with missing or specific User-Agent headers as bots, unauthenticated attackers can bypass authentication protections entirely.

The ability to perform unrestricted brute-force attacks significantly increases the risk of unauthorized account access and potential compromise of sensitive user data. With a CVSS score of 7.5, this vulnerability represents a high-risk security flaw that could lead to full account takeover, resulting in operational disruption and potential regulatory non-compliance regarding user authentication security.

Immediate Action: Monitor the official WWBN AVideo GitHub repository for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review web access logs for unusual spikes in login attempts or requests originating from clients with suspicious or missing User-Agent headers.

Compensating Controls: Implement a Web Application Firewall (WAF) to block or rate-limit suspicious traffic patterns and enforce strict User-Agent requirements at the perimeter level.

Public Exploit Available: Unknown

Given the high severity of this authentication bypass, administrators must prioritize the protection of login endpoints. While waiting for an official vendor patch, it is recommended to restrict access to login interfaces by IP address or employ additional authentication layers to mitigate the risk of brute-force attempts until the underlying code flaw is resolved.