CVE-2026-26227: VLC for Android Auth Bypass Vulnerability

CVE-2026-26227 Overview

CVE-2026-26227 is an authentication bypass vulnerability in VideoLAN VLC for Android prior to version 3.7.0. The vulnerability exists in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. Because the Remote Access Server uses a 4-digit OTP and does not enforce effective throttling or lockout within the OTP validity window, an attacker with network reachability to the server can repeatedly attempt OTP verification until a valid user_session cookie is issued.

Critical Impact

Successful exploitation allows unauthorized access to the Remote Access interface, enabling attackers to access media files explicitly shared by the VLC for Android user without proper authentication.

Affected Products

• VideoLAN VLC for Android prior to version 3.7.0

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-26227 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-26227

Vulnerability Analysis

This vulnerability falls under CWE-307 (Improper Restriction of Excessive Authentication Attempts). The core issue stems from the implementation of OTP-based authentication in the VLC for Android Remote Access Server feature. With only a 4-digit OTP space (10,000 possible combinations), the authentication mechanism requires robust rate limiting to prevent brute-force attacks. However, the affected versions fail to implement adequate throttling or account lockout mechanisms.

An attacker positioned on the same network as the victim's Android device can systematically enumerate all possible OTP values. Given the limited keyspace and absence of rate limiting, a complete brute-force attack is computationally trivial and can be accomplished within the OTP validity window. Upon successful OTP verification, the server issues a valid user_session cookie, granting the attacker access to the Remote Access interface.

Root Cause

The root cause is the absence of proper rate limiting controls on the OTP verification endpoint. The implementation allows unlimited authentication attempts within the OTP validity period, making brute-force attacks feasible against a 4-digit OTP. Effective mitigations would include implementing exponential backoff, account lockout after failed attempts, or increasing OTP complexity.

Attack Vector

The attack requires network-level access to the VLC for Android Remote Access Server. An attacker on the same local network can target the OTP verification endpoint and systematically attempt all possible 4-digit combinations. The network-based attack vector means that anyone on the same WiFi network or with network reachability to the Android device running VLC can potentially exploit this vulnerability.

The attack flow involves:

1. Identifying a device running VLC for Android with Remote Access Server enabled
2. Initiating connection to the Remote Access Server
3. Systematically brute-forcing the 4-digit OTP until authentication succeeds
4. Receiving a valid user_session cookie upon successful OTP verification
5. Accessing shared media files through the Remote Access interface

Detection Methods for CVE-2026-26227

Indicators of Compromise

• Multiple rapid authentication attempts to the VLC Remote Access Server from a single IP address
• High volume of OTP verification requests within a short time period
• Successful authentication following numerous failed attempts from the same source
• Unexpected access to shared media files from unknown network sources

Detection Strategies

• Monitor network traffic for unusual patterns of requests to VLC Remote Access Server ports
• Implement network-level detection for brute-force attack signatures targeting OTP endpoints
• Review VLC application logs for excessive authentication failures followed by success
• Deploy intrusion detection rules to identify rapid sequential authentication attempts

Monitoring Recommendations

• Enable logging on VLC for Android Remote Access Server if available
• Monitor local network traffic for suspicious activity targeting mobile devices
• Implement network segmentation to limit exposure of mobile devices running VLC
• Use network monitoring tools to detect brute-force patterns on the local network

How to Mitigate CVE-2026-26227

Immediate Actions Required

• Update VLC for Android to version 3.7.0 or later immediately
• Disable the Remote Access Server feature if not actively needed
• Limit network exposure by avoiding use of Remote Access Server on untrusted networks
• Monitor for unauthorized access to shared media files

Patch Information

VideoLAN has addressed this vulnerability in VLC for Android version 3.7.0. Users should update to this version or later through the official VideoLAN VLC Android Download page or Google Play Store. Additional details about the release can be found in the GitHub VLC-Android Release 3.7.0. The VulnCheck VLC Android Advisory provides further technical information about this vulnerability.

Workarounds

• Disable the Remote Access Server feature in VLC for Android settings until the update can be applied
• Only enable Remote Access Server on trusted, private networks with proper access controls
• Use VPN or network isolation to restrict access to the VLC Remote Access Server
• Consider using alternative methods for media sharing that do not rely on OTP authentication