CVE-2026-58447: Invidious Auth Bypass Vulnerability

CVE-2026-58447 Overview

CVE-2026-58447 is a broken object level authorization vulnerability in Invidious, an open-source alternative front-end to YouTube. The flaw affects Invidious releases through 2.20260626.0 and is fixed in commit 77ad416. Authenticated attackers can delete videos from other users' playlists by submitting an arbitrary global video index to the remove_video action of the playlist endpoint. The server performs the deletion without validating playlist ownership. Attackers can enumerate valid index values from the public playlist JSON API and use them to permanently remove videos from any playlist. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated Invidious user can permanently delete videos from playlists owned by other users, causing integrity loss across the platform.

Affected Products

Invidious through version 2.20260626.0
Invidious deployments prior to commit 77ad41678b45c4f6815940123f1796fc51259f45
Self-hosted Invidious instances exposing authenticated playlist APIs

Discovery Timeline

2026-06-30 - CVE-2026-58447 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58447

Vulnerability Analysis

The defect resides in the playlist video deletion path within src/invidious/database/playlists.cr and src/invidious/routes/api/v1/authenticated.cr. The delete function accepts a single index parameter and issues a SQL DELETE against playlist_videos using only that index as the predicate. Because index is a global identifier that spans all playlists in the database, any authenticated user can supply an index belonging to another user's playlist. The server executes the deletion without checking whether the caller owns the target playlist.

Index values are not secret. The public playlist JSON API exposes per-video index values for any listed playlist. An attacker retrieves these indices through normal read operations and replays them against the authenticated deletion endpoint to remove videos from arbitrary playlists.

Root Cause

The root cause is a missing ownership check between the authenticated principal and the target object. The parameterized SQL query filters on WHERE index = $1 only, treating a client-supplied identifier as authoritative without joining against the playlist owner. This matches the pattern described by CWE-639, where authorization is bypassed through a user-controlled key.

Attack Vector

Exploitation requires an authenticated Invidious account and network access to the target instance. The attacker enumerates target playlist indices through the public JSON API, then issues an authenticated request to the remove_video action supplying the harvested index. No user interaction from the victim is required, and the deletion is permanent.

text

// Patch diff: src/invidious/database/playlists.cr
-  def delete(index)
+  def delete(index, plid : String)
     request = <<-SQL
       DELETE FROM playlist_videos *
-      WHERE index = $1
+      WHERE index = $1 AND plid = $2
     SQL

-    PG_DB.exec(request, index)
+    PG_DB.exec(request, index, plid)
   end

Source: iv-org/invidious commit 77ad416

The patch binds the deletion to the caller-scoped playlist identifier plid, ensuring the SQL statement only removes rows belonging to that playlist.

text

// Patch diff: src/invidious/routes/api/v1/authenticated.cr
-    Invidious::Database::PlaylistVideos.delete(index)
+    Invidious::Database::PlaylistVideos.delete(index, plid)
     Invidious::Database::Playlists.update_video_removed(plid, index)

Source: iv-org/invidious commit 77ad416

Detection Methods for CVE-2026-58447

Indicators of Compromise

Unexpected DELETE operations on the playlist_videos table where the acting session user does not match the playlist owner
HTTP requests to the authenticated playlist remove_video endpoint referencing playlist IDs the caller does not own
User reports of missing videos from playlists that were not modified by their owner

Detection Strategies

Enable query-level logging on PostgreSQL and correlate DELETE FROM playlist_videos statements against the authenticated user's owned plid values
Instrument the Invidious API layer to log the authenticated user ID alongside every remove_video invocation and the target playlist owner
Alert on high-frequency remove_video requests from a single account, which suggests scripted enumeration of harvested indices

Monitoring Recommendations

Retain application access logs long enough to reconstruct playlist mutation history for forensic review
Monitor the ratio of playlist reads to playlist deletions per account to surface anomalous accounts
Track failed and successful authentication events against Invidious to identify accounts exhibiting abuse patterns

How to Mitigate CVE-2026-58447

Immediate Actions Required

Upgrade Invidious to a build containing commit 77ad41678b45c4f6815940123f1796fc51259f45 or later
Audit database backups and application logs to identify unauthorized playlist video deletions since exposure began
Review authenticated user accounts for signs of abuse and rotate credentials for suspicious accounts

Patch Information

The fix is delivered in Invidious commit 77ad416, merged through Pull Request #5790 and tracked in Issue #5777. The patch adds the playlist identifier plid to the PlaylistVideos.delete function and updates the SQL predicate to WHERE index = $1 AND plid = $2, enforcing ownership at the database layer. Additional context is available in the VulnCheck Security Advisory.

Workarounds

Restrict Invidious registration and require administrator approval to reduce the pool of potential authenticated attackers
Place the authenticated API behind a reverse proxy that enforces stricter rate limiting on the playlist remove_video endpoint
Temporarily disable public playlist enumeration by making user playlists private until the patched build is deployed

bash

# Pull the patched Invidious source and rebuild
git clone https://github.com/iv-org/invidious.git
cd invidious
git checkout 77ad41678b45c4f6815940123f1796fc51259f45
docker compose build
docker compose up -d