TBK DVR4104 and DVR4216 devices as well as Novo CeNova QSee Pulnix XVR 5 in 1 Securus Night OWL DVR Login HVR Login and MDVR Login which run re-branded versions of the original TBK DVR4104 and DVR4216 series allow remote attackers to bypass authentication via a \Cookie: uid=admin\ header as demonstrated by a device.rsp?opt=user&cmd=list request that provides credentials within JSON data in a response.