Zero Radar
← feed
CriticalVulnerabilityCVE-2026-61826updated 30 Oct 2026, 17:19 UTC

Bazarr Plex integration endpoints accept requests without login

Some Bazarr settings pages can be changed by anyone who can reach the app over the network, without signing in. An outsider could cut off the Plex link, change the API key, or send the app's Plex token to a server they control.

Partial fix · out Official source
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?PartlyBazarr 1.5.7-beta.14 adds authentication to the anonymous API-mutation path. Complete OAuth state validation is not established and remains a separate open item. · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Anonymous attackerNo login or API key needed
  2. 2Reaches web interfaceBazarr port reachable from their network
  3. 3Calls Plex endpointsUnauthenticated routes skip the login check
  4. 4Changes configSwaps API key or binds their Plex account
  5. 5Requests sent to attackerPlex token sent to attacker-chosen server
  6. ResultIntegration disabled or credentials exposed

What happened

Bazarr's api_ns_plex namespace (bazarr/api/plex/oauth.py) omits the @authenticate decorator on its Resource handlers, so endpoints such as /api/plex/oauth/logout, /api/plex/apikey, /api/plex/oauth/pin and /api/plex/select-server accept anonymous write operations. PlexPinCheck also skips OAuth state validation when state_param is absent and only logs mismatches.

Why it is dangerous: An anonymous attacker can disable the integration, persist an API key of their choice, bind their own Plex account to the instance, and redirect outbound requests that carry the configured API key in X-Plex-Token, enabling server-side request forgery and credential exposure. Anyone running Bazarr with the web interface reachable from a network they do not fully trust is at risk.

Are you affected?

You are affected if you run Bazarr earlier than 1.5.7-beta.14 with its web interface reachable by others, such as on a shared network or the internet.

Bazarr versions prior to 1.5.7-beta.14

What to do

  1. Update Bazarr to version 1.5.7-beta.14 or later.
  2. Check the Plex integration settings and API key, and reset them if you are unsure whether they were changed.
  3. Do not expose the Bazarr web interface to the internet; keep it behind a VPN or trusted network.

Timeline

  1. 30 Oct 2026, 17:17 UTC
    Publicly disclosed
  2. 30 Oct 2026, 17:17 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 17:19 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-61826
CVSS
10 / 10
Disclosed
30 Oct 2026, 17:17 UTC
On Zero Radar
30 Oct 2026, 17:19 UTC (2 min after disclosure)
Last change
30 Oct 2026, 17:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Bazarr Plex integration endpoints accept requests without login · Zero Radar