CVE-2023-49810 WWBN AVideo Improper Restriction of Excessive Authentication Attempts vulnerability

What is CVE-2023-49810?

CVE-2023-49810 is a high-severity vulnerability in Wwbn Avideo, published on 10 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to captcha bypass, which can be abused by an attacker to brute force user credentials. An attacker can send a series of HTTP requests to trigger this vulnerability.

Weakness: CWE-307

Which versions are affected by CVE-2023-49810?

2 open source packages ship an affected version, including wwbn/avideo. It affects 1 product.

Products include Wwbn Avideo.

How do I fix CVE-2023-49810?

No fix has been published for CVE-2023-49810 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-49810 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-49810 exists.

Other vulnerabilities in Wwbn Avideo

• CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks Critical 10.0
• CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection Critical 10.0
• CVE-2022-30534 Command injection in AVideo Critical 9.9
• CVE-2022-30547 Path traversal in AVideo Critical 9.9
• CVE-2022-32572 Command injection in AVideo Critical 9.9

All Wwbn Avideo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v977-h4hm-rrff.