WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlobal) that silently discards writes for any client identified as a bot by isBot(). Because isBot() treats a missing User-Agent header as a bot by default — and also matches common bot identifiers such as 'curl', 'bot', 'crawler', and 'spider' — the counter never increments for such clients, so the rate limit never fires. An unauthenticated attacker can therefore submit unlimited login attempts (e.g., by omitting the User-Agent header or using curl's default User-Agent), enabling unrestricted password-guessing attacks.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
WWBN AVideo versions up to e01e41ecc contain a critical authentication security flaw where the brute-force rate limiting mechanism can be completely bypassed by omitting or spoofing the User-Agent header. The enforceRateLimit() function relies on a cache layer that silently fails to record login attempts for clients identified as bots, and the isBot() function treats missing User-Agent headers—or common values like 'curl'—as automated requests. This vulnerability affects login.json.php and 13 other sensitive endpoints, allowing attackers to conduct unlimited brute-force attacks against user credentials without triggering rate-limit protections. With a CVSS score of 7.5, this is particularly dangerous for organizations running vulnerable AVideo instances, as it directly undermines a foundational security control and enables credential compromise at scale.
Casky's security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying CWE-307 (Improper Restriction of Rendered UI Layers or Frames) and related authentication bypass techniques. While this CVE doesn't map to specific MITRE ATT&CK techniques, practitioners using Casky would identify suspicious activity through skill assessments focused on T1110 (Brute Force), T1078 (Valid Accounts), and T1021 (Remote Services). A practitioner's findings would reveal patterns such as: repeated failed login attempts from a single source with missing or anomalous User-Agent headers, no corresponding cache entries for these attempts, and a spike in authentication failures that correlates with requests lacking standard browser identifiers. Casky's skills would flag the absence of rate-limit enforcement as a configuration or code-level vulnerability, prompting immediate investigation of the enforceRateLimit() implementation and isBot() logic—enabling teams to patch or compensate before credential stuffing campaigns succeed.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-82644. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation