CVE-2026-84476

8.7 highEPSS 0.4%

High (8.7). EPSS 0.4% chance of exploitation in the next 30 days.

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-290
Published: 2026-09-01
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-gg65-574p-h4wc
https://www.vulncheck.com/advisories/wwbn-avideo-authentication-bypass-via-x-real-ip-header
https://github.com/WWBN/AVideo/security/advisories/GHSA-gg65-574p-h4wc

Check your stack JSON