CVE-2026-129131

MEDIUM 5.3

Gameyfin before 2.6.2 Missing Authorization in Hilla Endpoints

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.

CWE	CWE-862
Vendor	gameyfin
Product	gameyfin
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for gameyfin gameyfin

Be the first to know when new medium vulnerabilities affecting gameyfin gameyfin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

gameyfin / gameyfin

0 < 2.6.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gameyfin/gameyfin/issues/1017 github.com: https://github.com/gameyfin/gameyfin github.com: https://github.com/gameyfin/gameyfin/commit/2515f1693c88bfa8145882fd85b790638738032c github.com: https://github.com/gameyfin/gameyfin/pull/1018 github.com: https://github.com/gameyfin/gameyfin/releases/tag/v2.6.2 github.com: https://github.com/gameyfin/gameyfin/blob/1ec9d627228bb77cf2485e259a58d37afa98f2b7/app/src/main/kotlin/org/gameyfin/app/core/security/LiveSubscriptionSecurity.kt#L22 vulncheck.com: https://www.vulncheck.com/advisories/gameyfin-before-2.6.2-missing-authorization-in-hilla-endpoints

Credits

hieuPenguinnn grimsi