External risk intelligence

WWBN AVideo Authentication Bypass and Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-86729

AVideo is a web-based video platform typically deployed as a public-facing web application. This vulnerability exists within an API endpoint intended for authentication, which is commonly exposed to the internet to allow remote user access and service functionality.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The WWBN AVideo platform has a vulnerability in its API that allows attackers to bypass authentication by guessing credentials without limit. This could lead to unauthorized access and takeover of user accounts.

Unauthenticated API allows unlimited password guessing.
Compromise of user accounts leads to data exposure.
Confirm relevance and exposure of the video platform.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by interacting with an undocumented API endpoint that bypasses rate limiting and provides feedback on credential validity. This allows for rapid, unauthenticated guessing of user passwords. Successful guesses grant access by establishing a session cookie, enabling further authenticated API requests.

Unauthenticated network access required.
Triggered by guessing user credentials.
Allows account takeover via session hijacking.

Live Threat

Current exploitation, exposure, and threat context

The WWBN AVideo plugin's API could allow an unauthenticated attacker to guess user credentials. This is because the `get_api_preauthorize` endpoint does not limit login attempts and reveals whether a username is valid. When supported by the advisory, this could lead to unauthorized access and session hijacking.

User accounts.
Unlimited password guessing.
Account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in WWBN AVideo impacts application owners and infrastructure teams responsible for the AVideo deployment. The first practical step is to identify all AVideo instances, confirm their exposure and criticality, and locate the accountable owner to plan remediation.

Application owners must triage.
Verify unpatched instances are isolated.
Plan secure updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WWBN AVideo?

WWBN AVideo is an open-source, web-based video platform designed for hosting, streaming, and managing video content. It functions as a comprehensive media server, often used by organizations to build their own private or public video distribution networks. The software includes various plugins to handle user authentication and API communications, which are essential for managing accounts and accessing protected content.

How does CVE-2026-86729 allow unauthorized access?

This vulnerability is classified as CWE-307, which involves improper restriction of excessive authentication attempts. In AVideo, a specific API endpoint lacks the rate-limiting protections applied to standard login methods. Because the system does not throttle requests, an attacker can automate rapid password guessing to brute-force accounts. The endpoint further assists this by confirming valid user IDs, turning it into an information oracle that aids in hijacking accounts.

What triggers this authentication vulnerability?

The flaw is triggered when an unauthenticated actor sends requests to the undocumented 'get_api_preauthorize' endpoint. Normal user interaction with the standard login portal, which properly enforces rate limits, does not trigger this vulnerability. The risk specifically arises because this secondary API path operates without any security throttling, allowing persistent and repeated authentication attempts that the application would otherwise block.

Is my AVideo instance at risk?

According to Halo Surface Signal, AVideo is typically deployed as a public-facing web application. Since the vulnerable API endpoint is accessible over the network without requiring prior authentication, any instance exposed to the internet is at higher risk of being targeted. If your deployment is reachable via the public internet, it should be treated as a priority for review compared to internal-only systems, as it is reachable by external actors.

What should I do to address this issue?

If you manage an AVideo instance, begin by identifying all deployed versions to determine your current footprint. Since no patched version is currently available, focus on operational containment. Verify your network security controls and consider isolating the application from the public internet if possible. Locate the technical owner of the platform to monitor for future updates and implement temporary mitigations to block unauthorized access to the affected API endpoint.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.