A critical authentication bypass vulnerability in WWBN AVideo allows unauthenticated attackers to circumvent two-factor authentication and audit logging by spoofing the User-Agent header.

This vulnerability, categorized as CWE-290, occurs because the application uses easily spoofed client-supplied User-Agent headers to validate login-time security controls. An attacker can bypass two-factor authentication and brute-force protections by setting the header to specific literals.

The ability to bypass two-factor authentication presents a severe risk of unauthorized account access, potentially leading to full compromise of administrative or user accounts. With a CVSS score of 9.1, this flaw poses a critical threat to data confidentiality and integrity, as attackers can operate without triggering standard security audit trails or brute-force mitigation.

Immediate Action: As no patch is currently available, administrators should restrict access to the application via network-level controls or a VPN to mitigate exposure.

Proactive Monitoring: Review web server access logs for anomalous User-Agent strings or successful logins that lack corresponding two-factor authentication events.

Compensating Controls: Implement a Web Application Firewall (WAF) to block or sanitize requests containing suspicious User-Agent headers, or disable the vulnerable encoder/mobile app features if they are not required for business operations.

Public Exploit Available: Unknown

Given the critical severity of this authentication bypass, organizations must treat this vulnerability with extreme urgency. Since a vendor patch is not yet available, organizations should prioritize implementing the suggested compensating controls and monitoring measures to prevent unauthorized access. Monitor the vendor advisory page for updates and apply the official patch immediately upon release.