CVE-2026-92583

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1

Description A race condition exists in the enforceRateLimit() function that fails to atomically increment rate limit counters. This allows attackers to bypass all rate limits, including login brute-force protection, by issuing concurrent requests. Consequently, attackers can submit parallel credential attempts to exceed the 30-attempts-per-5-minutes login limit by a factor determined by their connection concurrency.

Recommendations Update to a version newer than 29.0.