CVE-2026-57946: Invidious Auth Bypass Vulnerability

CVE-2026-57946 Overview

CVE-2026-57946 is a broken access control vulnerability [CWE-862] in Invidious, an open-source alternative front-end for YouTube. Versions prior to 2.20260626.0 expose private playlist contents through the RSS feed endpoint without requiring authentication. Attackers who know or guess a playlist identifier can request the RSS feed and receive the full playlist contents, the associated video entries, and the owner's email address. The vulnerability requires no credentials, no user interaction, and is exploitable over the network. Instance operators running public Invidious deployments should upgrade to version 2.20260626.0 or later.

Critical Impact
Unauthenticated remote attackers can retrieve private playlists and owner email addresses by supplying a playlist ID to the RSS feed endpoint.

Affected Products

Invidious versions prior to 2.20260626.0
Self-hosted Invidious instances exposing the RSS feed endpoint
Public Invidious deployments serving private user playlists

Discovery Timeline

2026-06-29 - CVE-2026-57946 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57946

Vulnerability Analysis

Invidious exposes playlist Atom/RSS feeds through a route handler in src/invidious/routes/feeds.cr. The handler retrieves a playlist by its identifier and returns the video entries as an XML feed. In vulnerable releases, the handler does not verify that the requester owns a playlist marked as private before returning its contents. The result is an information disclosure that leaks private video collections and the owner's email address.

The flaw is categorized under Missing Authorization [CWE-862]. Exploitation requires only an HTTP GET request against the feed endpoint with a valid playlist identifier. EPSS data places the exploitation probability at 0.272%.

Root Cause

The root cause is the absence of an authorization check between playlist lookup and response generation. The route fetched playlist metadata and video data, then serialized the response without comparing the playlist owner's email to the requesting session user. Private-playlist enforcement existed on other endpoints but was not applied to the RSS feed path.

Attack Vector

An unauthenticated attacker sends an HTTP request to the playlist feed endpoint supplying the target playlist identifier (plid). The server returns an Atom feed containing the playlist title, owner email address, and video entries regardless of the playlist's privacy setting. Playlist identifiers can be obtained through prior reconnaissance, log leakage, or enumeration.

text

       if playlist = Invidious::Database::Playlists.select(id: plid)
         videos = get_playlist_videos(playlist, offset: 0)
 
+        user = env.get?("user").try &.as(User)
+        if !playlist || playlist.privacy.private? && playlist.author != user.try &.email
+          return error_atom(404, "Playlist does not exist.")
+        end
+
         return XML.build(indent: "  ", encoding: "UTF-8") do |xml|
           xml.element("feed", "xmlns:yt": "http://www.youtube.com/xml/schemas/2015",
             "xmlns:media": "http://search.yahoo.com/mrss/", xmlns: "http://www.w3.org/2005/Atom",

Source: GitHub Commit c435dc1. The patch adds an explicit ownership check that returns a 404 error when the requesting user is not the playlist author.

Detection Methods for CVE-2026-57946

Indicators of Compromise

Unauthenticated HTTP GET requests to the /feed/playlist/<plid> endpoint from external or unusual source addresses.
Requests to the playlist feed endpoint that lack a session cookie or authorization header but return non-empty Atom XML payloads.
Bursts of sequential or enumerated playlist identifiers in web server access logs.

Detection Strategies

Parse reverse proxy or Invidious access logs for requests to playlist feed routes and correlate against known private playlist identifiers.
Alert on unauthenticated feed responses whose payload size indicates a populated playlist rather than an empty or error response.
Compare source IP addresses hitting feed endpoints against expected RSS aggregator user agents and geographies.

Monitoring Recommendations

Enable verbose access logging on the front-end proxy fronting Invidious and forward logs to a centralized analytics platform.
Track baseline request rates to /feed/playlist/ and alert on sudden spikes or scans across many playlist IDs.
Monitor outbound data volumes from the Invidious instance for anomalous transfers correlated with feed endpoint activity.

How to Mitigate CVE-2026-57946

Immediate Actions Required

Upgrade Invidious to version 2.20260626.0 or later, which contains the authorization check added in pull request #5776.
Audit web server access logs for prior unauthenticated requests to playlist feed endpoints and notify affected users whose private playlists may have been accessed.
Rotate or notify users whose email addresses may have been exposed through the feed response.

Patch Information

The fix is committed in c435dc1 and released in Invidious v2.20260626.0. The patch introduces an ownership check that compares playlist.author to the authenticated session user's email and returns a 404 error when the playlist is private and the requester is not the owner. Additional context is available in the VulnCheck advisory and GitHub Issue #5775.

Workarounds

Restrict access to the /feed/playlist/ route at the reverse proxy layer to authenticated sessions until the upgrade is applied.
Disable public registration and set the instance to private mode if operating a small-community deployment.
Block or rate-limit requests to feed endpoints from unauthenticated clients using web application firewall rules.

bash

# Example nginx rule blocking unauthenticated access to playlist feed endpoints
location ~ ^/feed/playlist/ {
    if ($cookie_SID = "") {
        return 403;
    }
    proxy_pass http://invidious_upstream;
}