WWBN AVideo includes a rate‑limiting mechanism that tracks login and other endpoints in a global cache. When a client is flagged as a bot, the counter is never incremented because the request counter is silently discarded. The system identifies a bot when the User‑Agent header is missing or contains common bot identifiers, such as "curl", "bot", "crawler", or "spider". As a result, clients that omit a User-Agent header bypass the rate limit entirely, allowing unlimited login attempts and enabling an attacker to perform unrestricted password‑guessing attacks.

The vulnerability affects the WWBN AVideo product version e01e41ecc and all earlier releases. It impacts the login.json.php endpoint and 13 additional protected endpoints. Upgrading to the latest AVideo release that contains a patch to the enforceRateLimit() function removes this bypass.

The CVSS base score of 8.7 classifies this flaw as high severity, and although the EPSS score is not available, the lack of a User‑Agent header can be easily supplied in standard HTTP requests, making exploitation straightforward for remote attackers. The issue is not listed in the CISA KEV catalog, yet its prevalence and the absence of a rate limit mean that any external actor can run large‑scale brute‑force campaigns against affected installations without detection.