Missing Authorization Vulnerability in Gameyfin Affects Unauthenticated Access

CVE-2026-129131

What is CVE-2026-129131?

Gameyfin versions prior to 2.6.2 contain a vulnerability that enables unauthenticated attackers to bypass login restrictions by exploiting Hilla endpoints marked with @AnonymousAllowed. This results in attackers gaining unauthorized access to synchronous endpoint methods like GameEndpoint.sync, which do not undergo security checks by LiveSubscriptionSecurity. Consequently, this allows them to extract crucial game catalog metadata, libraries, platforms, plugins, and game requests without the need for authentication.

References