WWBN AVideo Vulnerability: Critical Security Controls Bypassed
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- wwbn-avideo (npm)
- Affected versions
- >= 29.0, <= 29.0 or >= 26.0, <= 26.0 or >= 25.0, <= 25.0 or >= 24.0, <= 24.0 or >= 22.0, <= 22.0 or >= 21.0, <= 21.0 or >= 18.0, <= 18.0 or >= 14.3.1, <= 14.3.1 or >= 14.3, <= 14.3 or >= 12.4, <= 12.4 or >= 11.6, <= 11.6 or >= 11.5, <= 11.5 or >= 11.1.1, <= 11.1.1 or >= 11.1, <= 11.1 or >= 11, <= 11 or >= 10.8, <= 10.8 or >= 8.9.1, <= 8.9.1 or >= 8.9, <= 8.9 or >= 8.7, <= 8.7 or >= 8.6, <= 8.6 or >= 8.5, <= 8.5 or >= 8.1, <= 8.1 or >= 7.8, <= 7.8 or >= 7.7, <= 7.7 or >= 7.6, <= 7.6 or >= 7.4, <= 7.4 or >= 7.3, <= 7.3 or >= 7.2, <= 7.2 or >= 4.0, <= 4.0 or >= 3.4, <= 3.4 or >= 2.7, <= 2.7 or >= 2.2, <= 2.2
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in WWBN AVideo that allows bypassing of security controls using a specific User-Agent header. Users of affected versions should take immediate action.
What happened
An early warning has been issued regarding a critical vulnerability in WWBN AVideo. The vulnerability, tracked as CVE-2026-84479, allows an attacker to bypass three login-time security controls by setting the User-Agent header to AVideoEncoder. This bypass includes two-factor authentication, brute-force captcha escalation, and login/device audit history recording. The affected versions span a wide range, from 29.0 down to 2.2, inclusive of all versions in between.
The vulnerability was first flagged on 2026-09-01. It is currently under investigation and has not been exploited in the wild. Users are advised to monitor for updates or patches from the AVideo maintainers and consider implementing additional security measures to protect against potential exploitation.
What to do about it
- Monitor for any updates or patches from the AVideo maintainers.
- Consider implementing additional security measures to protect against potential exploitation.
- Review your current security controls and assess whether they are sufficiently robust against header-based attacks.
- If using an affected version, evaluate the risk and consider upgrading to a non-affected version if available.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
wwbn-avideo is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using WWBN AVideo version 29.0 or earlier, down to and including version 2.2.
What should I do right now?
Monitor for any updates or patches from the AVideo maintainers and consider implementing additional security measures to protect against potential exploitation.
Has an official fix been released?
No official fix has been published yet. Continue to monitor the sources for updates.
What is the severity of this vulnerability?
The vulnerability is classified as CRITICAL with a CVSS score of 9.1.