CVE-2026-56380: AVideo Information Disclosure Vulnerability

CVE-2026-56380 Overview

CVE-2026-56380 is an information exposure vulnerability in AVideo through commit 9c39d8c8. The flaw resides in feed/index.php and allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. The RSS feed response includes the itunes:email and itunes:author elements, which expose the creator's email address. Attackers can enumerate all creator email addresses by iterating through public channel names, enabling targeted phishing and account takeover attempts. The vulnerability is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can harvest email addresses of every public channel owner on an AVideo instance, fueling phishing and credential-stuffing campaigns.

Affected Products

AVideo platform (WWBN/AVideo)
All versions through commit 9c39d8c8
Instances exposing feed/index.php with public channels

Discovery Timeline

2026-08-22 - CVE-2026-56380 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-56380

Vulnerability Analysis

AVideo is an open-source video streaming platform maintained by WWBN. The application exposes an RSS-style feed at feed/index.php that accepts a public channel name as a request parameter. When the endpoint generates the podcast-compatible RSS output, it includes the channel owner's email address inside the itunes:email and itunes:author XML elements.

Because the endpoint requires no authentication, any remote actor can query it. By iterating through known or enumerated public channel names, an attacker can extract every registered creator's email address from a target instance. The disclosed data supports downstream attacks such as spear phishing, credential stuffing, and account takeover attempts against the AVideo admin panel and linked accounts.

The issue is tracked publicly in the GitHub Security Advisory GHSA-w44x-v4c8-86f6 and the VulnCheck advisory.

Root Cause

The root cause is over-inclusion of sensitive user data in a public-facing RSS response. The feed generator in feed/index.php embeds the account email associated with the channel owner into iTunes podcast metadata fields without applying access control or masking. RSS podcast schemas allow optional contact addresses, but AVideo populated these fields with the actual account email rather than a channel-specific or opt-in contact value.

Attack Vector

Exploitation requires only network access to the AVideo instance. An attacker issues an HTTP GET request to feed/index.php with a target channel name parameter and parses the returned XML for the itunes:email and itunes:author elements. Repeating this request across enumerated channel names produces a full list of creator email addresses. No credentials, user interaction, or elevated privileges are required.

Refer to the VulnCheck advisory for the request pattern and affected element details.

Detection Methods for CVE-2026-56380

Indicators of Compromise

Repeated unauthenticated HTTP GET requests to /feed/index.php with varying channel name parameters from the same source IP.
Web server responses containing itunes:email values in RSS output served to external clients.
Sudden spikes in RSS feed traffic that do not correlate with legitimate podcast client user agents.

Detection Strategies

Inspect HTTP access logs for enumeration patterns against feed/index.php, particularly sequential or dictionary-based channel name values.
Deploy web application firewall rules that flag or rate-limit unauthenticated requests to feed/index.php.
Correlate RSS endpoint access with subsequent phishing indicators such as inbound mail to harvested creator addresses.

Monitoring Recommendations

Alert on high-volume access to /feed/ endpoints exceeding baseline thresholds per source IP.
Track outbound RSS responses containing itunes:email fields until the platform is patched.
Review authentication logs for account takeover attempts targeting creators whose email addresses may have been exposed.

How to Mitigate CVE-2026-56380

Immediate Actions Required

Update AVideo to a commit later than 9c39d8c8 that removes the email fields from the RSS output.
Restrict public access to feed/index.php at the reverse proxy or WAF layer until a patched build is deployed.
Notify content creators of the exposure and require password resets plus multi-factor authentication where supported.

Patch Information

Refer to the WWBN/AVideo GitHub Security Advisory GHSA-w44x-v4c8-86f6 for the fix commit and upgrade guidance. Administrators running a self-hosted deployment should pull the latest master branch after the advisory's fix commit and redeploy.

Workarounds

Block or authenticate the /feed/index.php route at the web server, reverse proxy, or WAF until the patch is applied.
Modify the feed template locally to omit the itunes:email and itunes:author elements, or replace them with non-sensitive placeholders.
Rate-limit requests to the RSS endpoint per source IP to slow bulk enumeration.

bash

# Example nginx configuration to require authentication on the feed endpoint
location = /feed/index.php {
    auth_basic "AVideo Feed";
    auth_basic_user_file /etc/nginx/.htpasswd;
    limit_req zone=feedzone burst=5 nodelay;
}