Live › vulnerability › CVE-2026-61826
Bazarr, a companion app for Sonarr and Radarr, exposes Plex OAuth and server-configuration endpoints without authentication. An anonymous attacker can clear or replace the API key, bind their own Plex account, and make the server send its API key to attacker-chosen URLs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Any Bazarr instance before 1.5.7-beta.14 that is reachable by someone who should not manage it, since the affected Plex API routes skip the authentication that other Bazarr APIs enforce. Instances that are not reachable from untrusted networks, or that do not use the Plex integration, have a smaller exposure. Teams running Bazarr behind authenticated access only are less exposed, but the sources say the state-validation gap remains open.
No product ranges from the sources yet.
1.5.7-beta.14POST /api/plex/oauth/logout answering without an API key1.5.7-beta.14 or later, which adds authentication to these endpointsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the api_ns_plex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST /api/plex/oauth/logout to clear credentials and disable the integration, or POST /api/plex/apikey to persist an attacker-selected key, without a PIN, account or state precondition. POST /api/plex/oauth/pin and GET /api/plex/oauth/pin/<pin_id>/check additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. PlexPinCheck skips state validation when state_param is absent and merely logs a mismatch without stopping execution. POST /api/plex/select-server, POST /api/plex/oauth/servers, POST /api/plex/webhook/create, POST /api/plex/webhook/delete and POST /api/plex/encrypt-apikey expose further write_config() operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in X-Plex-Token, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.
This page as .md · .json · in your agent: get_signal("CVE-2026-61826")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.