Threats tagged 'ghsa-r2r4-gj52-gh46'

Gameyfin versions before 2.6.2 have a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by accessing certain endpoints. Attackers can call Hilla endpoints annotated with @AnonymousAllowed, including synchronous endpoint methods like GameEndpoint.sync, which are not checked by LiveSubscriptionSecurity. This enables retrieval of game catalog metadata, libraries, platforms, plugins, and game requests without authentication.