CyberRota Analysis
AI-GeneratedWWBN AVideo is vulnerable due to inadequate validation of trusted proxies for the X-Real-IP and X-Forwarded-For headers, enabling attackers to spoof client IP addresses. This flaw allows for the circumvention of login rate limiting, facilitating unlimited credential guessing attacks. Organizations using AVideo should prioritize addressing this vulnerability to protect against potential brute-force attacks on user accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.