GAMEYFIN · CVE-2026-129131 · Other
NO FIX YET · SEE WHAT TO DO
Gameyfin, a self-hosted game library manager, has a missing authorization check on Hilla endpoints marked AnonymousAllowed. An unauthenticated attacker can bypass login-required mode and read game catalog metadata, libraries, platforms, plugins and game requests.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any Gameyfin instance before 2.6.2 that runs with login-required mode enabled is exposed, because unauthenticated requests to synchronous Hilla endpoints such as GameEndpoint.sync are not checked. Instances with login-required mode off have no login to bypass, and the data read is catalog metadata, not credentials.
Not affected if gameyfin-2.6.2-or-later, login-not-required-mode
Who cares gameyfin, hilla, java, self-hosted
2.6.2 is affected.2.6.2 or later.Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.