Vulnerability · Published Sep 1, 2026 · Assigned by VulnCheck

CVE-2026-84479WWBN AVideo Authentication Bypass via User-Agent Header

Critical 9.1

In plain English

A critical-severity authentication bypass by spoofing in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 53.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – through 29.0

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-m9m3-gwh2-337c) vendor-advisory
VulnCheck Advisory: WWBN AVideo Authentication Bypass via User-Agent Header third-party-advisory