CyberRota Analysis
AI-GeneratedAVideo versions up to e01e41ecc are vulnerable due to a critical flaw that relies solely on the client-supplied User-Agent header for key security checks, allowing attackers to bypass two-factor authentication and evade detection. This vulnerability poses a significant risk as it enables unauthorized access while circumventing essential security measures. Organizations using AVideo should prioritize immediate action to mitigate this risk, as no patch is currently available.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.