CVE-2026-82643 WWBN AVideo Unauthenticated Rate Limit Bypass via preauthorize.json.php
Attackers can bypass rate limits to perform password guessing and trigger excessive two-factor emails, risking account takeover and service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82643?
CVE-2026-82643 is a medium-severity vulnerability in WWBN AVideo, published on 30 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php that accepts credentials over GET without rate limiting. Attackers can submit correct credentials repeatedly to trigger uncapped two-factor confirmation emails and perform sustained password guessing attacks against user accounts.
Weakness: CWE-307
Which versions are affected by CVE-2026-82643?
How do I fix CVE-2026-82643?
No fix has been published for CVE-2026-82643 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82643 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82643 exists.
Sources
Also known as GHSA-5fcm-q2vr-hhjh.