VULNERABILITY INTELLIGENCE
CVE-2026-26227
CVSS score3.7 LOW
EPSS probability0.33%
CISA KEVNot currently listed
Published2026-02-26
Last modified2026-10-13
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4-digit OTP and does not enforce effective throttling or lockout within the OTP validity window, allowing an attacker with network reachability to the server to repeatedly attempt OTP verification until a valid user_session cookie is issued. Successful exploitation results in unauthorized access to the Remote Access interface, limited to media files explicitly shared by the VLC for Android user.
Weakness classification
- disclosure@vulncheck.com: CWE-307