Description

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-01T23:17:22.083Z",
  "pubdate": "2026-09-01T23:17:22.083Z",
  "executiveSummary": "WWBN AVideo (version e01e41ecc and earlier) contains a critical authentication bypass vulnerability stemming from the improper use of client-supplied HTTP User-Agent headers for security-sensitive logic. The application relies on the 'isAVideoEncoder()' and 'isAVideoMobileApp()' functions to enforce security controls, which determine trust based solely on string matching against literal values in the 'HTTP_USER_AGENT' header.\nThis design flaw allows unauthorized actors who possess valid credentials to circumvent mandatory Two-Factor Authentication (2FA), bypass brute-force mitigation mechanisms (such as CAPTCHAs), and evade security logging and audit history tracking. Because these controls do not verify the legitimacy of the request through secondary factors like source IP validation, cryptographic tokens, or shared secrets, they are inherently insecure. The vulnerability significantly lowers the barrier for account takeover and unauthorized access, as an attacker can masquerade as a trusted mobile application or encoder component simply by modifying their request headers. Given the lack of a current patch, the risk of exploitation is high for environments where these features are enabled or exposed.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of trust boundaries within the AVideo authentication workflow. The application utilizes the 'isAVideoEncoder()' and 'isAVideoMobileApp()' functions to differentiate between standard browser-based users and trusted client applications. These functions perform a direct equality check between the 'HTTP_USER_AGENT' server variable and hardcoded strings ('AVideoEncoder' or 'AVideoMobileApp').\nBecause the 'HTTP_USER_AGENT' header is entirely controlled by the client, it is untrusted user input. By failing to implement additional authentication factors—such as API keys, session-bound secrets, or IP-based access control lists—the developers have created a trivial bypass vector. An attacker can perform a man-in-the-middle (MITM) or proxy-based manipulation to modify the User-Agent header of any outgoing HTTP request.\nThe exploitation flow proceeds as follows: 1) The attacker obtains valid user credentials. 2) The attacker initiates the login process. 3) Before the authentication challenge is processed, the attacker injects the 'User-Agent: AVideoEncoder' or 'User-Agent: AVideoMobileApp' header into the request. 4) The server-side logic receives the request and executes the insecure checks, concluding that the request originates from a trusted mobile or encoder client rather than a standard web browser. 5) Consequently, the backend logic proceeds to disable 2FA requirements and bypasses security thresholds related to brute-force protection (e.g., CAPTCHA).\nFurthermore, the logic failure extends to the audit subsystem. Since the application identifies these requests as 'system' or 'encoder' events rather than standard user logins, they are often excluded from standard security logging or are logged with insufficient context, allowing attackers to remain undetected during unauthorized access. The vulnerability affects all versions of WWBN AVideo up to and including commit e01e41ecc. There are no requirements for elevated privileges to perform this bypass; only valid user credentials are required, and the attack is fully executable over standard network interfaces (HTTP/HTTPS) with no requirement for the attacker to actually be running the legitimate client software. The post-exploitation impact includes full account compromise, unauthorized content access, and administrative control depending on the permissions associated with the compromised credentials, with minimal traces left in the audit logs."
}