CVE-2026-86186

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description The API fails to enforce rate limits when clients use a bot User-Agent header. This allows attackers to bypass eight protected operations, including login brute-force protection, by sending requests with a bot User-Agent to disable rate limiting. Consequently, an attacker can perform unlimited password guessing attempts against any account from a single IP address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.