What’s Vulnerable › Vulnerabilities

CVE-2026-84476: WWBN AVideo Authentication Bypass via X-Real-IP Header

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-01 · updated 2026-09-08
• Weakness: CWE-290

Description

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.

Affected products

• WWBN AVideo: through 29.0

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-gg65-574p-h4wc
• https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-x-real-ip-header
• https://github.com/WWBN/AVideo/security/advisories/GHSA-gg65-574p-h4wc

Get alerted when CVE-2026-84476 or the next vulnerability affects your stack