CVE-2026-84476 — WWBN AVideo Authentication Bypass via X-Real-IP Header
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). …
Published: 2026-09-01 · CVSS: 8.7 · CVSS 4.0
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7