The vulnerability in the preauthorize.json.php script allows attackers to submit any username and password pair via a GET request without authentication or rate limiting. When a valid credential set is supplied, the system sends an unlimited number of two‑factor authentication confirmation emails. This grants attackers the ability to repeatedly attempt password combinations (password guessing) while avoiding detection by email throttling. The flaw is classified as CWE‑307, making it a weak password verification of authentication bypass. The primary impact is on account compromise risk, email system abuse, and potential denial of service due to excessive email traffic.

The flaw affects the WWBN AVideo application, specifically the Live API endpoint located at plugin/Live/api/preauthorize.json.php. All deployed instances of AVideo that contain this endpoint are vulnerable. No specific product version was listed, so administrators should examine any installed AVideo packages that include this file.

With a CVSS score of 6.9, the vulnerability is considered moderate severity. The lack of rate limiting makes exploitation trivial; an attacker does not need privileged access and can perform an automated brute‑force campaign. The EPSS score is not available, so historical exploitation data are unknown, and the vulnerability is not in the CISA KEV catalogue. Attackers can target the public endpoint over HTTP, potentially using automated scripts to submit numerous credential guesses and trigger a flood of two‑factor emails, thereby creating a denial‑of-service effect for legitimate users.