CVE-2026-26227 describes an authentication bypass vulnerability in VideoLAN VLC for Android before version 3.7.0. The Remote Access Server uses a 4-digit OTP for authentication but lacks proper rate limiting or lockout mechanisms within the OTP validity window. This allows an attacker with network access to brute-force OTP verification attempts until a valid user_session cookie is obtained, bypassing authentication controls. The unauthorized access is restricted to media files shared by the VLC user via the Remote Access interface.

An attacker can gain unauthorized access to the VLC for Android Remote Access interface by brute forcing the 4-digit OTP due to missing or insufficient rate limiting. This access is limited to media files explicitly shared by the user. There is no indication of privilege escalation beyond this interface or broader system compromise. The vulnerability has a medium severity impact with a CVSS score of 6.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid enabling the Remote Access Server feature or restrict network access to it to trusted networks only. Monitor for vendor updates regarding patches or official mitigations.