Description

WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that silently discards writes for any client identified as a bot by isBot(). Because isBot() treats a missing User-Agent header as a bot by default — and also matches common bot identifiers such as 'curl', 'bot', 'crawler', and 'spider' — the counter never increments for such clients, so the rate limit never fires. An unauthenticated attacker can therefore submit unlimited login attempts (e.g., by omitting the User-Agent header or using curl's default User-Agent), enabling unrestricted password-guessing attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-30T15:16:44.727Z",
  "pubdate": "2026-08-30T15:16:44.727Z",
  "executiveSummary": "WWBN AVideo (version e01e41ecc and earlier) contains a critical security vulnerability involving a brute-force rate limiting bypass within the enforceRateLimit() function.\nThe flaw affects login.json.php and 13 additional endpoints, allowing unauthenticated attackers to perform unrestricted password-guessing attacks.\nThe vulnerability stems from an insecure implementation of bot detection that permits clients identified as bots to bypass the rate-limiting cache mechanism entirely.\nBecause the system fails to increment attempt counters for entities perceived as bots—including those with missing User-Agent headers—an attacker can execute brute-force attempts without triggering lockout mechanisms.\nThis vulnerability presents a significant risk, as it effectively nullifies account protection measures, facilitating unauthorized access through automated credential stuffing or brute-force scenarios.\nExploitation requires no authentication and can be performed remotely by simple manipulation of the HTTP User-Agent header, making it trivial for an adversary to leverage.",
  "technicalDetails": "The root cause of the vulnerability resides in the enforceRateLimit() function, which is designed to protect sensitive authentication and application endpoints. The function relies on a cache layer, specifically ObjectYPT::setCacheGlobal, to persist and track the number of failed login attempts for specific clients.\nThe logical failure occurs because the mechanism that persists the attempt counter is conditional upon the output of the isBot() function. If isBot() identifies a requester as a 'bot', the system silently discards the write operation to the cache. Consequently, the counter remains static, and the rate-limiting threshold is never reached, regardless of how many requests the client initiates.\nThe isBot() function implementation is overly permissive and prone to bypasses. It considers any request lacking a User-Agent header as a bot by default. Furthermore, it employs a matching heuristic that identifies common strings such as 'curl', 'bot', 'crawler', and 'spider'. An attacker can circumvent the intended security controls simply by stripping the User-Agent header from their HTTP requests or by utilizing tools like 'curl' without overriding the default User-Agent string.\nThe attack flow is as follows: 1) The attacker initiates an authentication request to an affected endpoint (e.g., login.json.php). 2) The server invokes enforceRateLimit() to check the existing cache counter. 3) If the attacker has stripped their User-Agent or set it to a blacklisted keyword, the server's isBot() check returns true. 4) The application logic skips the execution of ObjectYPT::setCacheGlobal, preventing the increment of the failed attempt counter. 5) The attacker receives a standard authentication failure response without the risk of an IP-based or session-based lockout. 6) The attacker repeats the request indefinitely to brute-force valid credentials.\nThis vulnerability is present in versions e01e41ecc and earlier. The flaw is reachable over the network without any authentication or specific privilege requirements. The post-exploitation impact is severe, as it removes the primary defense against automated credential attacks, significantly increasing the probability of successful account takeovers."
}