CVE-2026-56380: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo

CVE-2026-56380 is an information exposure vulnerability in AVideo's feed/index.php component. Unauthenticated attackers can supply a public channel name parameter to retrieve channel owner email addresses embedded in the itunes:email and itunes:author RSS elements. By iterating through public channel names, attackers can enumerate all creator email addresses. This exposure could be leveraged for account takeover attempts and phishing campaigns. The vulnerability affects version 0 of AVideo. There is no indication of known exploits in the wild or available patches.

The vulnerability allows unauthorized disclosure of channel owner email addresses, which can be used by attackers to conduct targeted phishing attacks or attempt account takeovers. No direct code execution or system compromise is described, but the exposure of sensitive contact information poses a significant privacy and security risk to users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider restricting access to RSS feeds or monitoring for suspicious activity related to exposed email addresses.