Is CVE-2026-26227 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26227 being exploited in the wild.

How severe is CVE-2026-26227?

Low severity, with a CVSS score of 3.7, published 26 February 2026.

Which products and versions are affected?

VideoLAN VLC for Android prior to 3.7.0.

Is there a fix for CVE-2026-26227?

A patch was published on 2026-02-26: Fixed in version 3.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26227 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-26227?

Check whether you run VideoLAN VLC for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26227: VideoLAN VLC for Android authentication bypass in Remote Access Server

CVE-2026-26227 · Severity: low · CVSS 3.7 · Published 2026-02-26

VLC for Android is a popular media player app that includes a Remote Access feature for sharing files over a network. A security flaw in this feature allows an unauthorized person on the same network to bypass password protections by repeatedly guessing a short 4-digit code. If successful, an attacker could view or download media files that the user has shared through the app.

Vendors: VideoLAN.

Quick answers

Is CVE-2026-26227 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26227 being exploited in the wild.
How severe is CVE-2026-26227?: Low severity, with a CVSS score of 3.7, published 26 February 2026.
Which products and versions are affected?: VideoLAN VLC for Android prior to 3.7.0.
Is there a fix for CVE-2026-26227?: A patch was published on 2026-02-26: Fixed in version 3.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26227 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-26227?: Check whether you run VideoLAN VLC for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an improper restriction of excessive authentication attempts (CWE-307) within the Remote Access Server component of VLC for Android. The server utilizes a 4-digit one-time password (OTP) for authentication but fails to implement effective rate limiting, throttling, or account lockout mechanisms during the OTP validity window. An attacker with network reachability can perform a brute-force attack against the 10,000 possible combinations to obtain a valid user_session cookie. Successful exploitation grants unauthorized access to the Remote Access web interface, though impact is limited to media files explicitly shared by the user. The issue is resolved in version 3.7.0.

Affected products

VideoLAN VLC for Android prior to 3.7.0

Timeline

2026-02-26: advisory
2026-02-26: disclosed
2026-02-26: patched: Fixed in version 3.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.