CVE-2026-56380: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.
AI Analysis
Technical Summary
CVE-2026-56380 is an information exposure vulnerability in WWBN AVideo's feed/index.php component. Unauthenticated attackers can supply a public channel name parameter to retrieve channel owner email addresses embedded in the itunes:email and itunes:author RSS elements. By iterating through public channel names, attackers can enumerate all creator email addresses, which could facilitate account takeover attempts and phishing campaigns. The vulnerability has a CVSS 4.0 score of 6.9, indicating a medium severity impact. There is no vendor advisory or patch information available at this time.
Potential Impact
The vulnerability allows unauthenticated attackers to access sensitive information (channel owner email addresses) that should not be publicly exposed. This information disclosure can lead to targeted phishing campaigns and increase the risk of account takeover attacks against content creators on the platform.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the feed/index.php endpoint or implementing additional access controls to prevent unauthorized enumeration of channel owner email addresses.
CVE-2026-56380: Exposure of Sensitive Information to an Unauthorized Actor in WWBN AVideo
Description
AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.
CVSS v4.0
Score 6.9medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56380 is an information exposure vulnerability in WWBN AVideo's feed/index.php component. Unauthenticated attackers can supply a public channel name parameter to retrieve channel owner email addresses embedded in the itunes:email and itunes:author RSS elements. By iterating through public channel names, attackers can enumerate all creator email addresses, which could facilitate account takeover attempts and phishing campaigns. The vulnerability has a CVSS 4.0 score of 6.9, indicating a medium severity impact. There is no vendor advisory or patch information available at this time.
Potential Impact
The vulnerability allows unauthenticated attackers to access sensitive information (channel owner email addresses) that should not be publicly exposed. This information disclosure can lead to targeted phishing campaigns and increase the risk of account takeover attacks against content creators on the platform.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the feed/index.php endpoint or implementing additional access controls to prevent unauthorized enumeration of channel owner email addresses.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-21T02:05:47.495Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a899b98acd9273b490877ee
Added to database: 08/22/2026, 12:52:40 UTC
Last enriched: 08/22/2026, 13:08:14 UTC
Last updated: 08/23/2026, 02:01:28 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.