PT-2026-22170 · Videolan · Vlc For Android

Xavlimsg · Published 2026-02-26 · Updated 2026-02-28 · CVE-2026-26227

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions VideoLAN VLC for Android versions prior to 3.7.0

Description The Remote Access Server feature in VideoLAN VLC for Android has an authentication bypass due to inadequate rate limiting on one-time password (OTP) verification. The server utilizes a 4-digit OTP but lacks effective throttling or lockout mechanisms during the OTP validity period. An attacker with network access can repeatedly attempt OTP verification to obtain a valid user session cookie, leading to unauthorized access to the Remote Access interface. Access is limited to media files shared by the VLC for Android user through the interface. The affected API endpoint is not explicitly mentioned.

Recommendations Update VideoLAN VLC for Android to version 3.7.0 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-26227

Affected Products

Vlc For Android

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-26227 · Security Note
• https://https//github.com/videolan/vlc-android/releases/tag/3.7.0 · Patch
• https://videolan.org/vlc/download-android.html · Note
• https://vulncheck.com/advisories/vlc-for-android-remote-access-otp-authentication-bypass · Note
• https://twitter.com/CVEnew/status/2027744264080232946 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027106099824898321 · Twitter Post