CVE-2026-56380

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit 9c39d8c8

Description An information exposure issue exists in the 'feed/index.php' endpoint. Unauthenticated attackers can retrieve channel owner email addresses by providing a public channel name via a parameter. By iterating through public channel names, attackers can extract email addresses from the itunes:email and itunes:author RSS elements, which could facilitate phishing campaigns and account takeover attempts.

Recommendations Update AVideo to a version including commit 9c39d8c8 or later.