CVE-2026-86186 AVideo API Rate Limit Bypass via Bot User-Agent Header
Attackers can bypass API rate limits by spoofing bot User-Agent headers, enabling unlimited login brute-force attacks against user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86186?
CVE-2026-86186 is a medium-severity vulnerability in WWBN AVideo, published on 5 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing attempts against any account from a single IP address.
Weakness: CWE-307
Which versions are affected by CVE-2026-86186?
How do I fix CVE-2026-86186?
No fix has been published for CVE-2026-86186 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86186 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86186 exists.
Sources
Also known as GHSA-54jr-hcr3-c8jp, GHSA-qmmw-hmm4-xxp7.