Description

WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustained password guessing attacks against user accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-30T15:16:44.583Z",
  "pubdate": "2026-08-30T15:16:44.583Z",
  "executiveSummary": "WWBN AVideo is susceptible to an unauthenticated credential submission vulnerability located within the plugin/Live/api/preauthorize.json.php file. This security flaw stems from the application's failure to enforce rate limiting or authentication checks on critical credential processing endpoints that accept parameters via the GET protocol. The vulnerability allows remote, unauthenticated attackers to conduct brute-force or credential-stuffing attacks by programmatically submitting combinations of usernames and passwords. Furthermore, the lack of request throttling enables an adversary to trigger an excessive volume of two-factor authentication (2FA) notification emails, resulting in a potential denial-of-service condition regarding the mail server or user inbox saturation. This vulnerability poses a significant risk to user account integrity, as it facilitates unauthorized access to authenticated sessions through automated password guessing. Exploitation requires no prior authentication or administrative privileges, making the system highly susceptible to automated reconnaissance and credential harvesting campaigns initiated over the network.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of the authentication pre-authorization logic within plugin/Live/api/preauthorize.json.php. The application exposes an API endpoint that processes credential submissions directly through HTTP GET requests, which is inherently insecure as these parameters may be logged by web servers, proxies, or cached by intermediate network devices. The absence of a request throttling mechanism or an account lockout policy allows an attacker to script high-frequency iterations of credential testing.\nThe exploitation flow begins with an attacker identifying the reachable endpoint at plugin/Live/api/preauthorize.json.php. Because the endpoint does not validate the request origin or session state, an attacker can automate the submission of varied credential pairs using standard HTTP clients or custom scripts. By injecting potential passwords as query parameters, the attacker forces the application to validate these credentials against the back-end authentication database.\nA critical consequence of this flaw is the uncapped triggering of two-factor authentication (2FA) workflows. If an attacker submits a valid credential pair for an account that has 2FA enabled, the backend system automatically generates and dispatches a secondary verification token via email. By repeatedly submitting correct credentials, an attacker can effectively weaponize the system to spam victims or overwhelm the mail transfer agent (MTA) integrated with the AVideo installation. This indicates a failure in the application's design to distinguish between legitimate login attempts and programmatic abuse.\nNetwork exposure is significant as the endpoint is accessible to any entity with connectivity to the web server hosting the AVideo instance. The lack of CSRF protection or server-side state validation for these GET requests allows the attacker to bypass standard login security controls. Post-exploitation, the attacker may gain full access to the target user's account if a credential match is identified. Furthermore, the ability to confirm the existence of accounts or verify the validity of compromised credentials represents a significant information disclosure risk, assisting attackers in refining their targeting for future credential-stuffing attacks. The vulnerability remains active as long as the endpoint lacks cryptographically secure request validation and robust rate-limiting controls."
}