CVE-2026-61826

Name of the Vulnerable Software and Affected Versions Bazarr versions prior to 1.5.7-beta.14

Description The api ns plex namespace in bazarr/api/plex/oauth.py lacks the @authenticate decorator on its Resource handlers, allowing anonymous users to perform unauthorized actions. Attackers can use the 'POST /api/plex/oauth/logout' endpoint to clear credentials and disable integration, or 'POST /api/plex/apikey' to set a custom API key. Additionally, 'POST /api/plex/oauth/pin' and 'GET /api/plex/oauth/pin//check' allow an attacker to bind a controlled Plex account token to the instance because PlexPinCheck fails to stop execution when state param is absent. Other affected endpoints include 'POST /api/plex/select-server', 'POST /api/plex/oauth/servers', 'POST /api/plex/webhook/create', 'POST /api/plex/webhook/delete', and 'POST /api/plex/encrypt-apikey', which allow unauthorized write config() operations. By providing attacker-controlled server URLs, an attacker can trigger server-side request forgery (SSRF)—a technique where the server is coerced into making requests to an unintended location—and expose the configured API key via the X-Plex-Token header.

Recommendations Update to version 1.5.7-beta.14.