MEDIUM 6.9 NVD
CVE-2026-56380
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-w44x-v4c8-86f6
- https://www.vulncheck.com/advisories/avideo-feed-index-php-exposure-of-channel-owner-email
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-08-22 via NVD.
vulnfeed aggregates 11022 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.