CVE-2026-129131

EUVD-2026-125548
Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/gameyfin/gameyfin
https://github.com/gameyfin/gameyfin/blob/1ec9d627228bb77cf2485e259a58d37afa98f2b7/app/src/main/kotlin/org/gameyfin/app/core/security/LiveSubscriptionSecurity.kt#L22
https://github.com/gameyfin/gameyfin/commit/2515f1693c88bfa8145882fd85b790638738032c
https://github.com/gameyfin/gameyfin/issues/1017
https://github.com/gameyfin/gameyfin/pull/1018
https://github.com/gameyfin/gameyfin/releases/tag/v2.6.2
https://www.vulncheck.com/advisories/gameyfin-before-2.6.2-missing-authorization-in-hilla-endpoints