{"id":"CVE-2026-26227","title":"VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification","summary":"VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-307"],"published":"2026-02-26","updated":"2026-10-13","sourceUpdated":"2026-10-13T02:16:58.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26227","references":[{"url":"https://github.com/videolan/vlc-android/releases/tag/3.7.0","label":"disclosure@vulncheck.com"},{"url":"https://www.videolan.org/vlc/download-android.html","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/vlc-for-android-remote-access-otp-authentication-bypass","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00509,"epssPercentile":0.41698,"ingestedAt":"2026-10-13T03:13:18.982Z","slug":"CVE-2026-26227","body":"## Overview\n\nVideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4-digit OTP and does not enforce effective throttling or lockout within the OTP validity window, allowing an attacker with network reachability to the server to repeatedly attempt OTP verification until a valid user_session cookie is issued. Successful exploitation results in unauthorized access to the Remote Access interface, limited to media files explicitly shared by the VLC for Android user.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}