EUVD-2026-125548

Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which...

CVE-2026-129131

Gameyfin versions prior to 2.6.2 are vulnerable to a missing authorization flaw in Hilla endpoints. The issue stems from the LiveSubscriptionSecurity component failing to check synchronous endpoint methods, such as GameEndpoint.sync , when they are annotated with @AnonymousAllowed . This allows u...