CVE-2026-56380

CVE-2026-56380 exposes creator email addresses through AVideo's RSS feeds via the itunes:email and itunes:author fields. These fields were copied from podcast RSS conventions to achieve iTunes compatibility, but a video platform's RSS feed serves a fundamentally different access context than a podcast feed—video platform feeds are consumed by general-purpose aggregators, search indexers, and content syndication tools, not a narrow podcast discovery ecosystem. The email field landed in a public-facing export channel without any access control classification, and the RSS endpoint has no rate limiting or authentication layer. The enumeration mechanism is trivially simple: iterate channel names, fetch the RSS, parse the XML, extract the email. This isn't a sophisticated attack—it's a design failure where the RSS pipeline was treated as a display concern rather than an API with security implications. The itunes:email field is likely deprecated integration—iTunes podcast compatibility has likely decayed as a priority for AVideo, yet the data exposure persists undiminished. Check your AVideo instance's RSS feed for itunes:email and itunes:author fields immediately. More importantly, audit what other metadata fields flow into your RSS and API export channels without access control classification. The pattern here—fields added for external compatibility requirements being treated as inert metadata—is a known class of failure in content management systems. This vulnerability likely existed for years before discovery given how trivially it enumerates. If your instance hasn't patched, treat any creator email harvested from your RSS feeds as compromised and monitor for targeted phishing or password reset attempts against those accounts. The fix likely removed these two fields, but the deeper question is whether AVideo has established a data classification layer that would catch the next unclassified sensitive field before it reaches an unauthenticated endpoint.

Reviewed through automated stages and approved by a human before publication.