CVE-2026-56380

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/WWBN/AVideo/security/advisories/GHSA-w44x-v4c8-86f6
https://www.vulncheck.com/advisories/avideo-feed-index-php-exposure-of-channel-owner-email-address
https://github.com/WWBN/AVideo/security/advisories/GHSA-w44x-v4c8-86f6

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) AVideo a través del commit 9c39d8c8 contiene una vulnerabilidad de exposición de información en feed/index.PHP que permite a atacantes no autenticados recuperar direcciones de correo electrónico de propietarios de canales al proporcionar un parámetro de nombre de canal público. Los atacantes pueden enumerar todas las direcciones de correo electrónico de los creadores al iterar a través de los nombres de canales públicos y extraerlas de los elementos RSS itunes:email e itunes:author, lo que permite intentos de toma de control de cuentas y campañas de phishing.

Information

Published : 2026-08-22 13:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-56380

Mitre link : CVE-2026-56380

CVE.ORG link : CVE-2026-56380

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-56380", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56380", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T19:30:42.442722Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "9c39d8c8b4c1f75540788d6b391740852ceb0732"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-22T13:16:37.977", "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-w44x-v4c8-86f6", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/avideo-feed-index-php-exposure-of-channel-owner-email-address", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-w44x-v4c8-86f6", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns."}, {"lang": "es", "value": "AVideo a trav\u00e9s del commit 9c39d8c8 contiene una vulnerabilidad de exposici\u00f3n de informaci\u00f3n en feed/index.PHP que permite a atacantes no autenticados recuperar direcciones de correo electr\u00f3nico de propietarios de canales al proporcionar un par\u00e1metro de nombre de canal p\u00fablico. Los atacantes pueden enumerar todas las direcciones de correo electr\u00f3nico de los creadores al iterar a trav\u00e9s de los nombres de canales p\u00fablicos y extraerlas de los elementos RSS itunes:email e itunes:author, lo que permite intentos de toma de control de cuentas y campa\u00f1as de phishing."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "disclosure@vulncheck.com"}