CVE-2026-56380 AVideo feed/index.php Exposure of Channel Owner Email Address
Unauthenticated attackers can extract channel owner email addresses from RSS feeds, facilitating phishing and account takeover attempts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56380?
CVE-2026-56380 is a medium-severity vulnerability in WWBN AVideo, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.
Weakness: CWE-200
Which versions are affected by CVE-2026-56380?
How do I fix CVE-2026-56380?
No fix has been published for CVE-2026-56380 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56380 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56380 exists.
Sources
Also known as GHSA-3f96-xq49-5fv9, GHSA-w44x-v4c8-86f6.