CVE-2026-84476

EUVD-2026-69718
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.67%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
wwbnavideo
𝑥
≤ 29.0
CNA
Common Weakness Enumeration
References
https://github.com/WWBN/AVideo/security/advisories/GHSA-gg65-574p-h4wc
https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-x-real-ip-header
https://github.com/WWBN/AVideo/security/advisories/GHSA-gg65-574p-h4wc