CVE-2026-26227VLC for Android < 3.7.0 Remote Access OTP Authentication Bypass
Updated under an hour ago ()
Does this affect you?
It affects VideoLAN VLC for Android. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4-digit OTP and does not enforce effective throttling or lockout within the OTP validity window, allowing an attacker with network reachability to the server to repeatedly attempt OTP verification until a valid user_session cookie is issued. Successful exploitation results in unauthorized access to the Remote Access interface, limited to media files explicitly shared by the VLC for Android user.
- CVSS
- 3.7 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness (CWE)
- CWE-307
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
VideoLAN VLC for Android videolan:vlc_for_android (from the name) | before 3.7.0 | CNA record |
References
- https://www.videolan.org/vlc/download-android.htmlproduct
- https://github.com/videolan/vlc-android/releases/tag/3.7.0patch
- https://www.vulncheck.com/advisories/vlc-for-android-remote-access-otp-authentication-bypassthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.