CVE-2026-26227Low· 3.7▾ SunlitVideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.6%
VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4-digit OTP and does not enforce effective throttling or lockout within the OTP validity window, allowing an attacker with network reachability to the server to repeatedly attempt OTP verification until a valid user_session cookie is issued. Successful exploitation results in unauthorized access to the Remote Access interface, limited to media files explicitly shared by the VLC for Android user.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-26228Medium· 4.9VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download
CVE-2026-115724Low· 2.9VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider
CVE-2026-112283Medium· 5.5libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points
CVE-2026-112282Medium· 5.5VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point
CVE-2026-112057Medium· 5.5libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
CVE-2026-112058Medium· 5.5libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT