{"id":"CVE-2026-61826","kind":"vulnerability","aliases":["CVE-2026-61826"],"related":[],"title":"Bazarr: unauthenticated Plex endpoints let anyone change config and steal credentials","description":"Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.","summary":"Bazarr, a companion app for Sonarr and Radarr, exposes Plex OAuth and server-configuration endpoints without authentication. An anonymous attacker can clear or replace the API key, bind their own Plex account, and make the server send its API key to attacker-chosen URLs.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bazarr","package","plex","radarr","self-hosted","sonarr"],"not_affected_if":["auth-required","managed-hosting","plex-disabled"],"how_to_check":"- Check the installed Bazarr version; affected if it is earlier than `1.5.7-beta.14`\n- Look for the Plex integration being reachable from untrusted networks, such as `POST /api/plex/oauth/logout` answering without an API key","fix":"- Bazarr: move to `1.5.7-beta.14` or later, which adds authentication to these endpoints\n- OAuth state validation is not fully fixed by that version according to the sources","status":"open","published_at":"2026-10-30T17:17:27+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:02+00:00","updated_at":"2026-10-30T17:32:02+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-30T17:32:02Z","model":"claude-haiku-5-5","output":{"fix":"- Bazarr: move to `1.5.7-beta.14` or later, which adds authentication to these endpoints\n- OAuth state validation is not fully fixed by that version according to the sources","reach":"network","title":"Bazarr: unauthenticated Plex endpoints let anyone change config and steal credentials","impact":"high","summary":"Bazarr, a companion app for Sonarr and Radarr, exposes Plex OAuth and server-configuration endpoints without authentication. An anonymous attacker can clear or replace the API key, bind their own Plex account, and make the server send its API key to attacker-chosen URLs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["bazarr","sonarr","radarr","plex","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Anonymous attacker disables integration, sets API key, and triggers server-side requests","analyst_note":"Confirm the fixed version in the NVD record and whether OAuth state validation has a planned fix; sources say it is a residual.","how_to_check":"- Check the installed Bazarr version; affected if it is earlier than `1.5.7-beta.14`\n- Look for the Plex integration being reachable from untrusted networks, such as `POST /api/plex/oauth/logout` answering without an API key","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting","plex-disabled"],"who_is_affected":"Any Bazarr instance before `1.5.7-beta.14` that is reachable by someone who should not manage it, since the affected Plex API routes skip the authentication that other Bazarr APIs enforce. Instances that are not reachable from untrusted networks, or that do not use the Plex integration, have a smaller exposure. Teams running Bazarr behind authenticated access only are less exposed, but the sources say the state-validation gap remains open.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000805,"input_tokens":4551,"output_tokens":699,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-61826':14A,17A '/api/plex/apikey':126C '/api/plex/encrypt-apikey':198C '/api/plex/oauth/logout':116C '/api/plex/oauth/pin':142C,145C '/api/plex/oauth/servers':191C '/api/plex/select-server':189C '/api/plex/webhook/create':193C '/api/plex/webhook/delete':195C '/check':146C '1.5.7':83C,244C 'absent':179C 'account':58B,137C,161C,165C 'add':254C 'addit':147C,233C 'allow':148C 'anonym':45B,111C,248C 'anyon':6A 'api':52B,65B,86C,100C,103C,216C,250C 'api-mut':249C 'app':29B 'applic':76C 'attack':46B,69B,131C,150C,158C,205C 'attacker-chosen':68B 'attacker-control':157C,204C 'attacker-select':130C 'authent':43B,93C,108C,255C 'bazarr':1A,18B,26B,72C 'bazarr/api/plex/oauth.py':91C 'beta.14':84C,245C 'bind':54B,163C 'caller':112C 'carri':213C 'chang':7A 'chosen':70B 'clear':48B,118C 'close':246C 'companion':28B,75C 'compens':110C 'complet':152C,256C 'config':8A,202C 'configur':40B,215C,236C 'control':159C,206C 'credenti':11A,119C,230C 'curat':269C 'cve':12A,15A 'denial':240C 'disabl':121C 'enabl':223C 'endpoint':4A,41B 'establish':262C 'execut':187C 'expos':34B,199C 'exposur':231C 'feed':209C 'forgeri':228C 'get':144C 'global':107C 'handler':97C 'hook':109C 'host':24B 'instanc':170C 'integr':123C,239C 'invok':114C 'key':53B,66B,104C,133C,217C 'later':210C 'let':5A 'log':182C 'make':60B 'mere':181C 'mismatch':184C 'mutat':251C 'namespac':89C 'normal':99C 'ns':87C 'oauth':36B,257C 'omit':92C 'oper':203C 'outbound':211C 'packag':19B 'param':177C 'path':252C 'persist':128C,235C 'pin':136C,154C 'plex':3A,20B,35B,57B,88C,160C,221C 'plexpincheck':171C 'post':115C,125C,141C,188C,190C,192C,194C,197C 'precondit':140C 'prior':81C 'radarr':21B,33B,80C 'remain':264C 'replac':50B 'request':212C,227C 'requir':101C 'residu':267C 'resourc':96C 'review':270C 'select':132C 'self':23B 'self-host':22B 'send':63B 'separ':266C 'server':39B,62B,207C,225C 'server-configur':38B 'server-sid':224C 'servic':242C 'side':226C 'skip':172C 'sonarr':25B,31B,78C 'state':139C,173C,176C,258C 'steal':10A 'stop':186C 'tamper':237C 'token':167C,222C 'unauthent':2A 'url':71B,208C 'valid':174C,259C 'version':243C 'without':42B,134C,185C 'write':201C 'x':220C 'x-plex-token':219C","nicknames":[],"mitigations":[],"who_affected":"Any Bazarr instance before `1.5.7-beta.14` that is reachable by someone who should not manage it, since the affected Plex API routes skip the authentication that other Bazarr APIs enforce. Instances that are not reachable from untrusted networks, or that do not use the Plex integration, have a smaller exposure. Teams running Bazarr behind authenticated access only are less exposed, but the sources say the state-validation gap remains open.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61826","severity":null,"published_at":"2026-10-30T17:17:27+00:00","modified_at":"2026-10-30T17:17:27+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}