Description
Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gameyfin | gameyfin | < 2.6.2 | 2.6.2 |
References
- GitHub Issue #1017 issue-tracking
- https://github.com/gameyfin/gameyfin product
- https://github.com/gameyfin/gameyfin/commit/2515f1693c88bfa8145882fd85b790638738032c patch
- https://github.com/gameyfin/gameyfin/pull/1018 issue-tracking patch
- gameyfin v2.6.2 Release Notes release-notes
- https://github.com/gameyfin/gameyfin/blob/1ec9d627228bb77cf2485e259a58d37afa98f2b7/app/src/main/kotlin/org/gameyfin/app/core/security/LiveSubscriptionSecurity.kt#L22 technical-description
- VulnCheck Advisory: Gameyfin before 2.6.2 Missing Authorization in Hilla Endpoints third-party-advisory