CVE-2026-57946 Invidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint
Unauthenticated attackers can access private playlist contents and owner emails via the RSS feed endpoint in Invidious.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57946?
CVE-2026-57946 is a medium-severity missing authorization vulnerability in iv-org Invidious, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.
Weakness: CWE-862
Which versions are affected by CVE-2026-57946?
How do I fix CVE-2026-57946?
No fix has been published for CVE-2026-57946 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-57946 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57946 exists.
Sources
Also known as GHSA-vppr-73v3-3pc6.