A critical flaw in WWBN AVideo lets an unauthenticated attacker who submits valid credentials defeat two-factor authentication, captcha escalation, and login auditing simply by setting the User-Agent header to AVideoEncoder.
What Is It
WWBN AVideo makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder() and isAVideoMobileApp() checks compare HTTP_USER_AGENT against a hardcoded literal, "AVideoEncoder" or "AVideoMobileApp", with no IP restriction and no shared secret. Because the header is fully attacker-controlled, the "is this a trusted first-party client?" decision is made by the client itself.
The issue is tracked as CWE-290 (Authentication Bypass by Spoofing) and was disclosed by VulnCheck.
Why It Matters
An attacker who submits valid credentials and sets User-Agent: AVideoEncoder gets three wins at once: two-factor authentication is bypassed, brute-force captcha escalation is skipped, and the session is never recorded in the login/device audit history. That last part is the sting, 2FA stops being a barrier against stolen or credential-stuffed logins, the rate-limiting backstop is removed, and the defender loses the audit trail that would have shown it happened.
The bug carries a CVSS 3.1 base score of 9.1 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and a CVSS 4.0 score of 9.3 (Critical). The vector is network-reachable and low-complexity, with no user interaction. The PR:N rating reflects that the attacker holds no privileges on the target before the request, the vulnerable code path is reachable at the unauthenticated login endpoint, while in practice the attack pairs the spoofed header with a credential the attacker already obtained elsewhere. Exploitation is a single header on an otherwise ordinary login request.
The CVE does not currently appear in the CISA Known Exploited Vulnerabilities catalog, which is publicly searchable and linked below. Absence from KEV means no exploitation has been publicly confirmed and cataloged; it is not evidence that exploitation is not occurring, particularly for a bug whose primary effect is to suppress the login records that would reveal it.
What's Vulnerable
- Vendor: WWBN
- Product: AVideo
- Affected versions: all versions up to and including 29.0 (current commit
e01e41eccand earlier)
Patch Status
No patch is available at the time of publication. The vendor advisory is published as GHSA-m9m3-gwh2-337c. Until a fix ships, operators of internet-facing AVideo instances should treat User-Agent-based trust as non-existent and consider restricting or fronting the login endpoint; genuine encoder and mobile-app traffic cannot be distinguished from spoofed traffic at the application layer as currently implemented.
Sources
- NVD, CVE-2026-84479: https://nvd.nist.gov/vuln/detail/CVE-2026-84479
- WWBN AVideo GitHub Security Advisory (GHSA-m9m3-gwh2-337c): https://github.com/WWBN/AVideo/security/advisories/GHSA-m9m3-gwh2-337c
- VulnCheck Advisory; WWBN AVideo Authentication Bypass via User-Agent Header: https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-user-agent-header
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog