VideoLAN VLC for Android Remote Access OTP Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in VideoLAN VLC for Android versions prior to 3.7.0. This issue arises in the Remote Access Server feature, where inadequate rate limiting on one-time password (OTP) verification allows an attacker to repeatedly attempt OTP validation. The Remote Access Server utilizes a 4-digit OTP but fails to implement effective throttling or lockout measures within the OTP's validity period. As a result, an attacker with network access to the server can exploit this flaw to gain unauthorized access to the Remote Access interface, specifically to media files shared by the VLC for Android user.

Impact

Exploitation of this vulnerability allows for unauthorized access to the Remote Access interface, limited to media files explicitly shared by the VLC for Android user.