CVE-2026-92583 — AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate li…
Published: 2026-09-16 · CVSS: 6.9 · CVSS 4.0
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential attempts to exceed the documented 30-attempts-per-5-minutes login limit by an arbitrary factor determined only by their connection concurrency.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7