Description

AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing attempts against any account from a single IP address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-05T13:18:13.560Z",
  "pubdate": "2026-09-05T13:18:13.560Z",
  "executiveSummary": "AVideo contains a critical security vulnerability where the API fails to enforce rate limiting mechanisms when specific User-Agent headers are detected.\nThis flaw allows remote, unauthenticated attackers to bypass security protections on eight sensitive API operations, most notably the login brute-force prevention system.\nBy manipulating the User-Agent header to mimic bot traffic, an attacker can negate existing rate limiting policies, allowing for high-frequency, unlimited password guessing attempts against any user account from a single source IP address.\nThe vulnerability significantly lowers the barrier for account takeover (ATO) attacks and credential stuffing campaigns.\nThe impact includes unauthorized account access, potential data exfiltration, and the compromise of user integrity within the AVideo platform.\nExploitation is trivial, requiring only the modification of the request header to include a bot-related User-Agent string, which serves as a signal for the application to disable defensive throttling.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the application's request filtering and rate limiting logic. The system utilizes the User-Agent HTTP header as a trusted criterion for evaluating whether to apply throttling, instead of relying on immutable attributes such as source IP address, session tokens, or API keys.\nWhen the application detects a User-Agent string identified as a bot, it erroneously classifies the request as a non-human, permitted transaction and proceeds to disable the configured security rate limits for the duration of that request. This logic effectively creates a bypass vector for eight core API operations protected by the system's defensive stack.\nThe attack flow proceeds as follows: First, the attacker identifies the target API endpoint and observes the default rate limiting behavior, which restricts the frequency of requests. Second, the attacker crafts a malicious HTTP request directed at the authentication or sensitive functionality. Third, the attacker injects a User-Agent header corresponding to known bots, crawlers, or automation tools into the request. Fourth, the server receives the modified request and, due to the flawed validation logic, marks the request as exempt from rate limiting.\nBy iterating this process, an attacker can perform unlimited authentication attempts against user accounts without being blocked, redirected, or slowed down. Because the rate limiter is fully disabled for these requests, the attacker can conduct high-velocity brute-force attacks from a single IP address, rendering standard IP-based blocking or temporary account lockouts ineffective as long as the malicious header is present.\nThis vulnerability is particularly severe because it allows for automated exploitation at scale, potentially leading to widespread unauthorized account access. The lack of secondary verification or server-side enforcement of rate limits, regardless of the User-Agent, constitutes a failure in secure API design. The exposure is network-wide, affecting all interfaces that rely on the flawed rate-limiting module."
}