The vulnerability in WWBN AVideo allows an attacker who has valid login credentials to bypass two‑factor authentication, skip the brute‑force captcha escalation, and remain invisible in the login/device audit history by simply setting the User‑Agent HTTP header to a hardcoded value such as "AVideoEncoder" or "AVideoMobileApp". The application’s isAVideoEncoder() and isAVideoMobileApp() checks rely exclusively on the User‑Agent string, with no IP or shared‑secret validation, creating a classic authentication bypass linked to CWE‑290. An attacker can gain privileged access to an account, potentially reading or manipulating sensitive data or performing further internal actions, without any additional privileges or exploitation steps beyond the login request.

The flaw affects the WWBN AVideo platform in all released versions up to and including the Git commit e01e41ecc. Users running any earlier or current release are potentially impacted unless they have removed or patched the authentication checks.

With a CVSS score of 9.3, the flaw is considered critical. No EPSS data is available, but the absence of a mitigation in the current code base and the simplicity of the exploit suggest a non‑zero likelihood of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog; however, the attack can be performed remotely by sending a crafted HTTP login request; the only prerequisite is an eligible user account. Consequently, the risk is high for any system that exposes AVideo’s login endpoint to untrusted users.