CVE-2026-56380 in AVideo
Summary
by MITRE • 08/22/2026
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in AVideo prior to commit 9c39d8c8 represents a significant information disclosure flaw located within the feed/index.php module of the application. This security defect allows unauthenticated remote attackers to access sensitive personal data belonging to content creators, specifically their email addresses associated with public channels. The root cause lies in how the RSS feed generation logic handles user-provided input for channel identification without adequate sanitization or authorization checks. When an attacker supplies a specific public channel name as a parameter, the application processes this request and constructs an RSS response that includes metadata about the channel owner. Crucially, this metadata is not restricted to publicly visible profile information but extends into fields intended for internal use or limited distribution, such as those used by podcast aggregators like iTunes.
From a technical perspective, the flaw exploits the structure of the generated RSS feed where specific XML elements are populated with user data without proper filtering. The itunes:email and itunes:author tags within the RSS output contain the email address of the channel owner. Because these fields are rendered in plain text within the public-facing feed endpoint, any individual can retrieve this information simply by making an HTTP request to the vulnerable script with a valid or guessed channel name. This mechanism bypasses standard authentication requirements because the vulnerability resides in data exposure rather than access control failure on protected routes; the route itself is accessible, but it returns more sensitive data than intended for public consumption.
The operational impact of this vulnerability extends beyond simple privacy violation. By enabling the enumeration of creator email addresses through iterative requests against known or guessed channel names, attackers can build comprehensive databases of user contact information. This capability significantly lowers the barrier for conducting targeted phishing campaigns and social engineering attacks. With valid email addresses in hand, threat actors can craft highly convincing spear-phishing messages that appear to originate from legitimate sources or reference specific content created by the victim, thereby increasing the likelihood of successful credential harvesting. Furthermore, this exposure facilitates account takeover attempts if users reuse passwords across platforms or if password reset mechanisms are susceptible to timing attacks or other exploitation techniques leveraging known email addresses.
This vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information about the environment, and more accurately with CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1589, Gather Victim Identity Information, specifically sub-technique T1589.001, Email Addresses. The ability to systematically enumerate these identifiers transforms a simple data leak into a reconnaissance tool that aids in subsequent phases of an attack chain, such as initial access via phishing or credential stuffing.
Mitigation strategies must focus on restricting the data exposed through public-facing APIs and feeds. Developers should ensure that sensitive fields like email addresses are never included in RSS feeds intended for general consumption unless explicitly required by external standards and even then, only with appropriate obfuscation or rate limiting. Implementing strict input validation and output encoding is essential to prevent unintended data leakage. Additionally, applying the principle of least privilege ensures that API endpoints return only the minimum necessary information for their function. For organizations using AVideo, upgrading to a version later than commit 9c39d8c8 where this issue has been patched is the primary remediation step. Until patching can be applied, administrators should consider implementing web application firewall rules to detect and block excessive enumeration attempts against the feed endpoint or restrict access to internal metadata fields within the RSS generation logic.