Vulnerability DatabaseCVE-2026-86186
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-86186
Published:September 05, 2026
Updated:September 22, 2026
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting and perform unlimited password guessing attempts against any account from a single IP address.
Related Resources (4)
https://nvd.nist.gov/vuln/detail/CVE-2026-86186
https://github.com/WWBN/AVideo/security/advisories/GHSA-qmmw-hmm4-xxp7
https://www.vulncheck.com/advisories/avideo-api-rate-limit-bypass-via-bot-user-agent-header
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86186.json
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Improper Restriction of Excessive Authentication Attempts
CWE-307
EPSS
Base Score:
0.18