IT SBIT Services
Schneeberger
DEEN
CVE tracker

Bazarr: Missing authentication on Plex OAuth API allows config tampering and SSRF

CVE-2026-61826Critical 10.0

← All vulnerabilities

Summary

Bazarr, a companion application to Sonarr and Radarr, did not require authentication on several Plex OAuth API endpoints. An unauthenticated attacker who can reach the web interface can clear the Plex credentials, set an attacker-chosen API key, or bind an attacker-controlled Plex account, and can change the Plex server URL. Attacker-controlled URLs then receive the configured API key in the X-Plex-Token header, which enables server-side request forgery and credential exposure. No user interaction is required.

Affected

  • Bazarr versions prior to 1.5.7-beta.14 (per the CVE record)

Fixed in

  • Bazarr 1.5.7-beta.14 (adds authentication to the Plex OAuth API endpoints)
  • Unknown: the first stable release containing this fix could not be verified; 1.6.2 is reported to contain it

Workaround

  • Unknown. No vendor workaround found.
  • Block external access to /api/plex/* at the reverse proxy or place SSO in front of it, without excluding /api from authentication, until patched.

Exploitation

  • Exploited in the wild: no evidence found, but not confirmed absent from CISA KEV.
  • Public proof of concept: none found in the searches performed.

Our recommendation

  • Upgrade Bazarr to 1.5.7-beta.14 or later; 1.6.2 is the practical stable choice for most SMEs.
  • Restrict access to the Bazarr web interface and /api from untrusted networks now.
  • After upgrading, check the Bazarr API key, Plex token, Plex server URL and webhook settings for unexpected changes.
  • Note that the CVE describes OAuth state validation as a separate open residual issue; monitor the upstream advisory.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:20.

Original description (NVD)

Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.

NVD references (4)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed

Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.