CVE-2026-92583: Wwbn Avideo

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential attempts to exceed the documented 30-attempts-per-5-minutes login limit by an arbitrary factor determined only by their connection concurrency.

Affected products

• Wwbn Avideo: up to and including 29.0

Published 2026-09-16. Last modified 2026-09-22.