Tautulli CVE-2026-32275

Requires Tautulli versions 1.3.10 through 2.16.x. Remote unauthenticated attacker sends crafted link with unsanitized JSONP callback parameter to victim user. Victim must click the link in their browser while authenticated to Tautulli to steal API key via cross-origin script injection.

Real-world risk is moderate despite the 7.4 CVSS score. The CVSS vector reveals critical limitations: high attack complexity (AC:H) and mandatory user interaction (UI:A) mean exploitation requires social engineering to trick authenticated Tautulli administrators into clicking malicious links. The vulnerability does not allow unauthenticated remote code execution or system compromise-impact is limited to credential theft (VC:H, VI:H) within the application's scope (SC:N, SI:N, SA:N indicate no impact to subsequent systems). No EPSS score provided, but absence from CISA KEV and no public POC suggests this is not being actively exploited in the wild. The SSVC framework would likely classify this as 'scheduled' rather than 'immediate' priority: exploitation requires user interaction (not automatable), technical impact limited to API key theft rather than system control, and the target audience is self-hosted Plex administrators rather than internet-facing enterprise infrastructure. Organizations running Tautulli should prioritize patching during regular maintenance windows, especially if the web interface is exposed to untrusted networks or users.

An attacker crafts a malicious URL containing JavaScript code in the JSONP callback parameter, such as tautulli.example.com/api/v2?callback=alert(document.cookie). The attacker sends this link to a Tautulli administrator via phishing email or social media, disguised as a legitimate notification or support request. When the authenticated administrator clicks the link while logged into Tautulli, the unsanitized callback executes in their browser context, allowing the attacker's script to steal session cookies and API keys, then exfiltrate them to an attacker-controlled server. With the stolen API key, the attacker can query Plex viewing history, user data, and potentially manipulate Tautulli configurations.