High severity7.5NVD Advisory· Published Sep 1, 2026· Updated Sep 8, 2026
CVE-2026-84476
CVE-2026-84476
Description
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
2- WWBN AVideo: 25 Vulnerabilities Disclosed in Early September 2026 BatchVypr Intelligence · Sep 5, 2026
- WWBN AVideo: 16 Vulnerabilities Disclosed, Including Critical Auth and Password Reset FlawsVypr Intelligence · Sep 1, 2026