Is there a patch available for EUVD-2026-40163?

Yes, a patch is available for EUVD-2026-40163. Update the affected software to the latest version immediately.

Invidious EUVD-2026-40163

Q: What is the CVSS score of EUVD-2026-40163?

EUVD-2026-40163 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-57946 MEDIUM

Missing Authorization (CWE-862)

2026-06-29 disclosure@vulncheck.com

GHSA-vppr-73v3-3pc6

Authentication Bypass

6.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AV:N and PR:N because the endpoint is network-accessible with no authentication required; AC:H because exploitation depends on prior knowledge of a private playlist ID; C:L for limited data disclosure with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 29, 2026 - 19:01 EUVD

Analysis Generated

Jun 29, 2026 - 18:38 vuln.today

DescriptionCVE.org

Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.

AnalysisAI

Unauthenticated access to private playlist data in Invidious before v2.20260626.0 is possible via a broken authorization check on the RSS feed playlist endpoint. By supplying a known playlist ID to this endpoint, a remote attacker with no credentials can retrieve the full contents of a private playlist, the owner's email address, and all associated video entries. No public exploit has been identified at time of analysis, and a vendor-released patch is available in v2.20260626.0.

Technical ContextAI

Invidious is an open-source, privacy-oriented alternative frontend for YouTube commonly deployed as a self-hosted instance. The vulnerability exists in the application's RSS feed endpoint, which is designed to allow users to subscribe to playlists via feed readers. CWE-862 (Missing Authorization) identifies the root cause: the endpoint accepts a caller-supplied playlist ID and returns playlist data without verifying whether the requesting party has permission to view that playlist. The access control gate that enforces playlist privacy is absent for this specific feed path, meaning private visibility settings set by the playlist owner are silently bypassed. The fix was introduced in commit c435dc1204970bcca06bcdcfb116c22092be22fd via pull request #5776.

RemediationAI

Upgrade Invidious to version 2.20260626.0 or later, which contains the authorization fix from pull request #5776. The release is available at https://github.com/iv-org/invidious/releases/tag/v2.20260626.0. If immediate patching is not feasible, a temporary workaround is to block access to the RSS feed playlist endpoint at the reverse proxy layer (e.g., deny requests matching the feed path that include a playlist parameter); note that this will break legitimate RSS feed subscriptions for all users until the patch is applied. Restricting the Invidious instance to authenticated users only at the network or proxy layer is an alternative compensating control, though it defeats the purpose of a public-facing instance. See the VulnCheck advisory at https://www.vulncheck.com/advisories/invidious-private-playlist-disclosure-via-unauthenticated-rss-feed-endpoint for further detail.