CVE-2026-82643 in AVideo
Summary
by MITRE • 08/30/2026
WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustained password guessing attacks against user accounts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/30/2026
The identified vulnerability resides within the WWBN AVideo platform, specifically targeting the preauthorization endpoint located at plugin/Live/api/preauthorize.json.php. This component is designed to handle initial authentication requests by accepting username and password credentials via HTTP GET parameters. The critical flaw lies in the absence of any rate limiting mechanisms or account lockout policies associated with this specific entry point. Because the application processes these credential submissions without imposing constraints on frequency, it creates a significant security gap that allows for unbounded interaction from external actors. This architectural oversight transforms what should be a controlled authentication process into an open vector for abuse, as there are no technical controls to detect or mitigate rapid successive requests originating from a single source IP address or associated with a specific user account.
From a technical perspective, the reliance on HTTP GET parameters for credential transmission is itself a suboptimal practice that exposes sensitive data in server logs and browser history, but the primary severity stems from the lack of throttling. When an attacker submits valid credentials through this endpoint, the system proceeds to trigger secondary authentication steps, such as sending two-factor confirmation emails or SMS codes. Since there is no cap on these actions, a malicious actor can automate requests to flood legitimate users with verification messages, resulting in a denial-of-service condition for those accounts. Furthermore, the absence of rate limiting facilitates sustained brute-force attacks against user passwords. Attackers can iteratively submit different password combinations without fear of being blocked or flagged by intrusion detection systems that rely on request frequency thresholds. This capability allows adversaries to systematically guess credentials until they achieve unauthorized access, particularly if users have selected weak or easily predictable passwords.
The operational impact of this vulnerability is twofold, affecting both the availability and confidentiality aspects of security. On one hand, the ability to trigger uncapped two-factor confirmation emails constitutes a resource exhaustion attack that can disrupt normal operations for targeted individuals by flooding their communication channels with spam-like verification requests. This not only degrades user experience but also increases the likelihood of users falling victim to social engineering attacks where they might inadvertently disclose codes sent during these floods. On the other hand, the sustained password guessing capability poses a direct threat to account integrity. Successful exploitation allows attackers to bypass initial authentication barriers and gain unauthorized access to private video content, administrative functions, or personal data stored within the platform. This compromise can lead to further lateral movement if the compromised accounts have elevated privileges or are linked to other critical systems.
This vulnerability aligns with CWE-307 Improper Restriction of Excessive Authentication Attempts, which describes flaws where an application fails to limit the number of authentication attempts allowed in a given time period. Additionally, it relates to CWE-284 Improper Access Control regarding the unauthenticated nature of certain credential submissions that should be strictly controlled. In terms of offensive security frameworks, this flaw supports techniques categorized under ATT&CK T1110 Brute Force and specifically T1110.003 Password Spraying if attackers attempt common passwords across many accounts, or T1110.001 Offline Password Guessing if they leverage the retrieved data for offline cracking after initial access. The use of GET parameters also touches upon CWE-598 Use of GET Request Method With Sensitive Query Strings, although this is secondary to the rate limiting failure.
To mitigate these risks, immediate remediation steps should focus on implementing robust rate limiting policies at both the application and network levels for all authentication-related endpoints. The preauthorize.json.php endpoint must be configured to reject requests that exceed a defined threshold of attempts per minute or hour from any single IP address or user identity. Implementing account lockout mechanisms after a small number of failed login attempts is also essential to prevent automated guessing attacks. Furthermore, migrating credential submission from HTTP GET parameters to POST methods with secure headers will help reduce exposure in logs and improve overall security posture. Deploying Web Application Firewalls (WAF) rules that detect and block abnormal authentication traffic patterns can provide an additional layer of defense while the underlying code is patched. Regular audits of authentication flows should be conducted to ensure no other endpoints suffer from similar deficiencies, ensuring comprehensive protection against credential-based attacks.