CVE-2026-86729 Details

A vulnerability in WWBN AVideo has been identified in the plugin/API/API.php file, specifically in the get_api_preauthorize function, as of commit e01e41ecc. This function serves as an undocumented login method that lacks any rate limiting, in contrast to the documented get_api_signIn method, which restricts attempts to 10 every 5 minutes. The absence of throttling on get_api_preauthorize allows for unlimited remote password guessing against any account, including administrative accounts. Additionally, this endpoint acts as a credential oracle, providing feedback on password validity while disclosing the user's ID. A correct password not only grants access but also establishes a session cookie for authenticated API requests. These factors combined enable unauthenticated brute-force account takeover.

To address this vulnerability, the get_api_preauthorize endpoint should be modified to include the same rate limit as the get_api_signIn endpoint. This can be done by adding a checkRateLimit call for the preauthorize function, ensuring that it shares the same attempt budget as the signIn method.