CVE-2026-56380: AVideo feed/index.php Exposure of Channel Owner Email Address
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 9c39d8c8 - Configuration
Apply the fix included in commit 9c39d8c8 to prevent unauthenticated retrieval of channel owner email addresses via the public channel name parameter in feed/index.php.
AVideo feed/index.php channel owner email exposure via public channel name parameter = mitigate information exposure by applying commit 9c39d8c8
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo deployments containing commit 9c39d8c8 are exposed if they have public channels. Any unauthenticated remote user can request feed/index.php with a public channel name.
What does an attacker need to exploit it?
The attacker needs only the name of a public channel and does not need an account, privileges, or user interaction. They can iterate through public channel names to collect creator email addresses.
How can I determine whether email addresses are being exposed?
Request the RSS feed for a public channel through feed/index.php and inspect the response for itunes:email or itunes:author elements. The presence of a channel owner's email address in those elements indicates exposure.
What is the likely impact of disclosure?
The disclosed addresses can be used to enumerate channel owners and support targeted phishing or account-takeover attempts. The reported impact is limited to confidentiality; no integrity or availability impact is identified.