WWBN AVideo up to 29.0 Login Security isAVideoEncoder/isAVideoMobileApp User-Agent improper authentication

Summaryinfo

A vulnerability has been found in WWBN AVideo up to 29.0 and classified as critical. The affected element is the function isAVideoEncoder/isAVideoMobileApp of the component Login Security. Performing a manipulation of the argument User-Agent results in improper authentication. This vulnerability was named CVE-2026-84479. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in WWBN AVideo up to 29.0. This affects the function isAVideoEncoder/isAVideoMobileApp of the component Login Security. The manipulation of the argument User-Agent with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-84479 since 09/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/02/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-69721). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion