CVE-2026-129131

CVSS 6.9 (medium) · published 2026-11-13

Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.

Weakness: CWE-862

Source: NVD CVE-2026-129131

References

• https://github.com/gameyfin/gameyfin
• https://github.com/gameyfin/gameyfin/blob/1ec9d627228bb77cf2485e259a58d37afa98f2b7/app/src/main/kotlin/org/gameyfin/app/core/security/LiveSubscriptionSecurity.kt#L22
• https://github.com/gameyfin/gameyfin/commit/2515f1693c88bfa8145882fd85b790638738032c
• https://github.com/gameyfin/gameyfin/issues/1017
• https://github.com/gameyfin/gameyfin/pull/1018
• https://github.com/gameyfin/gameyfin/releases/tag/v2.6.2
• https://www.vulncheck.com/advisories/gameyfin-before-2.6.2-missing-authorization-in-hilla-endpoints

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.