Description
VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4-digit OTP and does not enforce effective throttling or lockout within the OTP validity window, allowing an attacker with network reachability to the server to repeatedly attempt OTP verification until a valid user_session cookie is issued. Successful exploitation results in unauthorized access to the Remote Access interface, limited to media files explicitly shared by the VLC for Android user.
Problem types
CWE-307 Improper Restriction of Excessive Authentication Attempts
Product status
Any version before 3.7.0
Credits
XavLimSG
References
www.videolan.org/vlc/download-android.html
https//github.com/videolan/vlc-android/releases/tag/3.7.0
www.vulncheck.com/...remote-access-otp-authentication-bypass