Two unpatched flaws in Kaltura's video player let attackers read files and run code
CERT/CC has gone public with a pair of bugs in Kaltura's mwEmbed library. Both trace back to the same old web-security sin: trusting user-supplied serialized data.
Key points
- CERT/CC disclosed two unpatched vulnerabilities in Kaltura's HTML5 mwEmbed video player, tracked as CVE-2026-19912 and CVE-2026-19913.
- Both flaws let a remote attacker with no login read files from the server and run their own code on it.
- The root cause is unsafe deserialization in a single file, mwEmbedLoader.php.
- No patch is available at the time of publication, and Kaltura powers video on a long list of universities, broadcasters and enterprise sites.
The CERT Coordination Center, a US-based group that helps coordinate the public disclosure of software flaws, has gone public with two bugs in Kaltura's video player that do not yet have a fix.
Kaltura is the video engine sitting quietly behind a lot of the internet you already use: university lecture portals, corporate training sites, news video players. Its open-source HTML5 player is called mwEmbed. That is the piece with the problem.
The flaws are tracked as CVE-2026-19912 and CVE-2026-19913. Both were first reported by The Hacker News.
What can an attacker actually do?
An attacker anywhere on the internet, with no account and no password, can read files off the server running the player and run their own code on it. That is about as bad as a web bug gets.
Reading arbitrary files means the attacker can grab things like configuration files, database credentials, or private keys sitting on disk. Running code, in security jargon remote code execution, means they can install their own software on the server, pivot to other systems, or quietly sit and watch traffic.
Both bugs live in the same endpoint, a file called mwEmbedLoader.php. Hit that URL with the wrong kind of input and you are in.
How did the bug get there?
Both vulnerabilities come from unsafe deserialization, which is a fancy way of saying the code takes data sent by a stranger and unpacks it as if it were trusted.
Here is the plain version. Programs often turn complex data (a shopping cart, a user profile) into a compact string so they can save it or send it over the network. Turning it back into a usable object is called deserialization. If the program will deserialize whatever a random visitor sends it, an attacker can craft a booby-trapped string that, when unpacked, executes commands.
It is the PHP equivalent of a bug pattern that has haunted Java, Python and .NET apps for more than a decade. Not novel. Just unpatched.
Is there a fix yet?
No. At the time of writing, Kaltura has not shipped a patched version of mwEmbed, and CERT/CC's advisory lists no vendor-supplied mitigation.
| Detail | Value |
|---|---|
| Affected product | Kaltura HTML5 video player (mwEmbed) |
| Vulnerable file | mwEmbedLoader.php |
| CVE IDs | CVE-2026-19912, CVE-2026-19913 |
| Root cause | Unsafe PHP deserialization |
| Attacker needs an account? | No |
| Patch available? | Not at time of publication |
Administrators running self-hosted Kaltura installations should, at minimum, block outside access to mwEmbedLoader.php at the web server or firewall until Kaltura publishes a fix. Sites using Kaltura's cloud service should ask their account contact whether the hosted player is affected and what has been done about it.
Should ordinary viewers worry?
Probably not directly. These bugs put the servers hosting Kaltura at risk, not the laptops of people watching video on them. You cannot catch this by clicking play on a lecture recording.
The knock-on risk is the usual one. If a university or employer's Kaltura server gets broken into, whatever account details or internal documents live near it could leak. If you get an unexpected password-reset email from a site that uses Kaltura in the coming weeks, treat it with the same suspicion you would any other.
