CVE-2026-82644

Name of the Vulnerable Software and Affected Versions AVideo versions e01e41ecc and earlier

Description A rate limiting bypass exists in the enforceRateLimit() function, which is designed to protect the 'login.json.php' endpoint and 13 other endpoints. The function utilizes a cache layer ObjectYPT::setCacheGlobal to store attempt counters; however, this layer discards writes for clients identified as bots by the isBot() function. Since isBot() classifies requests without a User-Agent header or those containing identifiers such as 'curl', 'bot', 'crawler', and 'spider' as bots, the attempt counter does not increment for these clients. Consequently, an unauthenticated attacker can perform unrestricted password-guessing attacks by omitting the User-Agent header or using a default curl User-Agent.

Recommendations Update AVideo to a version later than e01e41ecc.