AVideo Login Bypass via User-Agent Spoofing

AVideo (current e01e41ecc and earlier) has a login-time security bypass vulnerability.

Three security controls (two-factor authentication, brute-force captcha escalation, and login/device audit history) rely solely on the client-supplied User-Agent header.

An attacker can bypass these controls by setting the User-Agent header to 'AVideoEncoder'.

• No patch is available at the time of publication.