The CERT Coordination Center (CERT/CC) has revealed two significant security vulnerabilities in Kaltura’s HTML5 video player library. These vulnerabilities allow remote attackers to access files and execute code on affected servers without authentication. These flaws, identified as CVE-2026-19913 and CVE-2026-19912, originate from insecure deserialization processes within the mwEmbedLoader.php endpoint, part of the mwEmbed player library distributed by Kaltura.
Vulnerability Details and Impact
The vulnerabilities do not require authentication or Kaltura session tokens, with network access to the endpoint being the only prerequisite for exploitation. CERT/CC has been unable to coordinate a response from Kaltura regarding these security issues. As a result, administrators are strongly advised to limit or disable external access to the affected endpoint and employ a restricted allow-list for the ServiceUrl parameter to ensure only valid backend API URLs are used.
As of August 25, 2026, there have been no reported exploitations of these vulnerabilities, and they are not listed in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalog. Kaltura, a platform for video management and integration, exposes the vulnerable loader on both customer installations and its shared production hosts, impacting multiple users.
Technical Breakdown of the Flaws
The first vulnerability, CVE-2026-19913, is linked to the ServiceUrl parameter, which directs backend API requests. This parameter can be manipulated to fetch local files instead of API responses, leading to the reflection of file contents in error messages. Researcher Gerjan Wemekamp demonstrated an escalation by retrieving sensitive configuration files containing database connections and passwords.
The second flaw, CVE-2026-19912, involves code execution via the uiconf_id parameter. This parameter can be exploited to write executable PHP code to a web-accessible directory, leading to unauthorized code execution. This requires the file-based cache backend, which is the default configuration for Kaltura.
Recommended Mitigation Strategies
In the absence of a patch, CERT/CC advises administrators to take several precautionary steps. These include blocking or removing the vulnerable endpoint, strictly allowing only legitimate API hosts, rejecting unsafe uiconf_id values, and denying PHP execution in cache directories. Additionally, rotating credentials exposed in local.ini and restricting outbound network access from the server are crucial measures to mitigate risks.
The affected versions include html5lib v2.45, v2.103, and earlier releases that expose the vulnerable endpoint. Wemekamp rated the code execution flaw with a severity score of 10.0 and the file access issue at 9.1. However, CERT/CC has not published official severity scores.
Response and Historical Context
Despite ongoing efforts to report these vulnerabilities to Kaltura since March 2026, the company has not responded or issued a fix. The research highlights a recurring issue with unsafe deserialization, similar to problems faced by other platforms such as Fastjson. Kaltura’s security.txt file indicates a bug bounty program on HackerOne for reporting vulnerabilities, but communication channels have so far yielded no resolution.
As the situation develops, administrators and users of Kaltura’s video platform must remain vigilant and implement the recommended security measures to protect their systems from potential exploitation.
