PT-2026-94100

CVE-2026-92583

Published

2026-09-16

Updated

2026-09-16

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1

Description A race condition exists in the enforceRateLimit() function that fails to atomically increment rate limit counters. This allows attackers to bypass all rate limits, including login brute-force protection, by issuing concurrent requests. Consequently, attackers can submit parallel credential attempts to exceed the 30-attempts-per-5-minutes login limit by a factor determined by their connection concurrency.

Recommendations Update to a version newer than 29.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Rajivraj

Vendors

Affected products

Weakness enumeration

CWE-307: Improper Restriction of Excessive Authentication Attempts

Related identifiers