AVideo CVE-2026-56380

No special conditions beyond network access to the AVideo instance and knowledge of at least one public channel name. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms fully unauthenticated exploitation with no complexity or interaction barriers. Channel names are typically discoverable through the platform's own public browse or search interface, enabling an attacker to enumerate both channel names and associated email addresses in a single automated sweep. Exploitation is limited by two factors: (1) the AVideo instance must be publicly internet-accessible - instances behind authentication walls, VPNs, or network-level access controls are not directly reachable; and (2) the vulnerability yields only email addresses, not passwords or session tokens, so account compromise requires a subsequent phishing or credential-stuffing step rather than being directly achievable through this flaw alone.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately characterizes the attack profile: no authentication, no complexity, and no user interaction are required, but the confidentiality impact is bounded to Low - email addresses rather than credentials or private content. No EPSS score was included in the source data, and this CVE does not appear in CISA KEV, leaving exploitation probability unquantified. The vulnerability is not independently critical in isolation, but the automated, unauthenticated enumeration path - scriptable in minutes using standard HTTP tooling - elevates it meaningfully above a theoretical finding; even a mid-sized municipal IT team in tczew operating an AVideo instance for public communications would face real risk to creator accounts if harvested emails are subsequently weaponized. The primary concern is the downstream attack chain: this vulnerability serves as a low-cost reconnaissance primitive that directly enables phishing and credential-stuffing campaigns against platform creators.

An attacker issues unauthenticated HTTP GET requests to a public AVideo instance at /feed/index.php?channel=<channelname>, iterating through channel names discoverable via the platform's browse or search pages. Each valid response returns an XML document embedding the channel owner's email address in the itunes:email and itunes:author fields, enabling systematic bulk harvesting. No public exploit code has been confirmed, but the attack requires only a scripted HTTP client and a channel name wordlist, making mass enumeration achievable with commodity tooling in a single automated session.