GHSA-r2r4-gj52-gh46MediumCVSS 5.3
Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated...
🔗 CVE IDs covered (1)
📋 Description
Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.
🔗 References (9)
- https://nvd.nist.gov/vuln/detail/CVE-2026-129131
- https://github.com/gameyfin/gameyfin/issues/1017
- https://github.com/gameyfin/gameyfin/pull/1018
- https://github.com/gameyfin/gameyfin/commit/2515f1693c88bfa8145882fd85b790638738032c
- https://github.com/gameyfin/gameyfin
- https://github.com/gameyfin/gameyfin/blob/1ec9d627228bb77cf2485e259a58d37afa98f2b7/app/src/main/kotlin/org/gameyfin/app/core/security/LiveSubscriptionSecurity.kt#L22
- https://github.com/gameyfin/gameyfin/releases/tag/v2.6.2
- https://www.vulncheck.com/advisories/gameyfin-before-2.6.2-missing-authorization-in-hilla-endpoints
- https://github.com/advisories/GHSA-r2r4-gj52-gh46