Invidious vulnerabilities
CVEs whose affected-version data names the Invidious package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-58447Medium· 6.5PoCInvidious - Cross-User Playlist Video Deletion via Missing Ownership Check
Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video i…
▾ Twilightiv-org · InvidiousEPSS 0.27%via CVEORG
CVE-2026-57946Low· 3.7PoCInvidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint
Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attacker…
▾ Twilightiv-org · InvidiousEPSS 0.35%via CVEORG