# CVE-2026-26227: VideoLAN VLC for Android authentication bypass in Remote Access Server

Source: https://junglewise.ai/threats/cve-2026-26227-videolan-vlc-for-android-authentication-bypass-in-remote-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-26. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-26227 · Severity: low · CVSS 3.7 · Published 2026-02-26

VLC for Android is a popular media player app that includes a Remote Access feature for sharing files over a network. A security flaw in this feature allows an unauthorized person on the same network to bypass password protections by repeatedly guessing a short 4-digit code. If successful, an attacker could view or download media files that the user has shared through the app.

Vendors: [VideoLAN](https://junglewise.ai/threats/vendors/videolan).

## Quick answers

**Is CVE-2026-26227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26227 being exploited in the wild.

**How severe is CVE-2026-26227?** Low severity, with a CVSS score of 3.7, published 26 February 2026.

**Which products and versions are affected?** VideoLAN VLC for Android prior to 3.7.0.

**Is there a fix for CVE-2026-26227?** A patch was published on 2026-02-26: Fixed in version 3.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26227 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-26227?** Check whether you run VideoLAN VLC for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as an improper restriction of excessive authentication attempts (CWE-307) within the Remote Access Server component of VLC for Android. The server utilizes a 4-digit one-time password (OTP) for authentication but fails to implement effective rate limiting, throttling, or account lockout mechanisms during the OTP validity window. An attacker with network reachability can perform a brute-force attack against the 10,000 possible combinations to obtain a valid user_session cookie. Successful exploitation grants unauthorized access to the Remote Access web interface, though impact is limited to media files explicitly shared by the user. The issue is resolved in version 3.7.0.

## Affected products

- VideoLAN VLC for Android prior to 3.7.0

## Timeline

- 2026-02-26: advisory
- 2026-02-26: disclosed
- 2026-02-26: patched: Fixed in version 3.7.0

## References

- [https://https//github.com/videolan/vlc-android/releases/tag/3.7.0](https://https//github.com/videolan/vlc-android/releases/tag/3.7.0)
- [https://www.videolan.org/vlc/download-android.html](https://www.videolan.org/vlc/download-android.html)
- [https://www.vulncheck.com/advisories/vlc-for-android-remote-access-otp-authentication-bypass](https://www.vulncheck.com/advisories/vlc-for-android-remote-access-otp-authentication-bypass)

## Related threats

- [VideoLAN VLC for Android path traversal in Remote Access Server](https://junglewise.ai/threats/cve-2026-26228-videolan-vlc-for-android-path-traversal-in-remote-access-server)