Vulnerability Description
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-gg65-574p-h4wc
- https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-x-rea
- https://github.com/WWBN/AVideo/security/advisories/GHSA-gg65-574p-h4wc
FAQ
What is CVE-2026-84476?
CVE-2026-84476 is a vulnerability with a CVSS score of 7.5 (HIGH). WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate th...
How severe is CVE-2026-84476?
CVE-2026-84476 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84476?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.