CVE-2026-86729

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit e01e41ecc

Description The software exposes an undocumented login path through the get api preauthorize() function in plugin/API/API.php. Unlike the standard login process, this path does not implement rate limiting via the checkRateLimit() function, allowing unlimited remote password guessing against any account, including administrators. Additionally, the endpoint functions as a credential oracle; while it returns a generic "Invalid credentials" message for all attempts, the users id field in the response body reveals the authentication status (users id:1 for success and users id:0 for failure). A successful attempt also establishes a session cookie that can be used for authenticated API requests, enabling unauthenticated brute-force account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.