CVE-2026-84476: Wwbn Avideo

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.

Affected products

• Wwbn Avideo: up to and including 29.0

Published 2026-09-01. Last modified 2026-09-08.