CVE-2026-57946: Iv-Org Invidious

Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.

Affected products

• Iv-Org Invidious: before 2.20260626.0 (fixed in 2.20260626.0)

Published 2026-06-29. Last modified 2026-07-14.