PT-2026-22170 · Videolan · Vlc For Android

Xavlimsg · Publicado 2026-02-26 · Atualizado 2026-02-28 · CVE-2026-26227

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions VideoLAN VLC for Android versions prior to 3.7.0

Description The Remote Access Server feature in VideoLAN VLC for Android has an authentication bypass due to inadequate rate limiting on one-time password (OTP) verification. The server utilizes a 4-digit OTP but lacks effective throttling or lockout mechanisms during the OTP validity period. An attacker with network access can repeatedly attempt OTP verification to obtain a valid user session cookie, leading to unauthorized access to the Remote Access interface. Access is limited to media files shared by the VLC for Android user through the interface. The affected API endpoint is not explicitly mentioned.

Recommendations Update VideoLAN VLC for Android to version 3.7.0 or later.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2026-26227

Produtos afetados

Vlc For Android

Referências · 6

• https://videolan.org/vlc/download-android.html · Nota
• https://vulncheck.com/advisories/vlc-for-android-remote-access-otp-authentication-bypass · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-26227 · Nota de Segurança
• https://twitter.com/CVEnew/status/2027744264080232946 · Publicação no Twitter
• https://https//github.com/videolan/vlc-android/releases/tag/3.7.0 · Correção
• https://twitter.com/VulmonFeeds/status/2027106099824898321 · Publicação no Twitter