CVE-2026-92583 Details

A race condition vulnerability has been identified in AVideo versions through 29.0, specifically within the enforceRateLimit() function. This vulnerability arises because the function fails to increment rate limit counters atomically, allowing attackers to bypass all rate limits, including those protecting against brute-force login attempts. By sending concurrent requests, attackers can exceed the stated limit of 30 login attempts per 5 minutes by a factor determined solely by their connection's concurrency.

To address this vulnerability, the rate limit counters should be incremented atomically. This can be done by using the cache backend's atomic increment feature, utilizing the database for rate limit management, or, if the file backend is necessary, by implementing file locking to ensure exclusive access during the read-modify-write process.