Bazarr
Monthly
Any remote, unauthenticated caller who can reach a Bazarr instance's `/api/plex/` endpoints can persistently rewrite its Plex configuration: `POST /api/plex/oauth/logout` clears the stored token, API key and server URL and disables the integration outright, while `POST /api/plex/apikey` stores an attacker-chosen key, and the unauthenticated `/api/plex/oauth/pin` plus `pin/<id>/check` pair lets an attacker bind their own Plex account token to the instance. The root cause is that the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` ships without the per-handler `@authenticate` decorator that all 65 sibling API handlers carry, and no global authentication hook compensates. Every release up to and including 1.5.6 is affected, and the vendor closed the anonymous API-mutation path in 1.5.7-beta.14; the CVE record is scored CVSS 10.0 and the vulnerability carries an act_now priority decision, though no public exploit code was identified at time of analysis. Attackers can additionally abuse attacker-supplied server URLs that are later fetched with the configured API key in an `X-Plex-Token` header, producing server-side request forgery and credential exposure against instances where a Plex integration is already configured.
An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Bazarr manages and downloads subtitles. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Bazarr manages and downloads subtitles. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Bazarr manages and downloads subtitles. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Any remote, unauthenticated caller who can reach a Bazarr instance's `/api/plex/` endpoints can persistently rewrite its Plex configuration: `POST /api/plex/oauth/logout` clears the stored token, API key and server URL and disables the integration outright, while `POST /api/plex/apikey` stores an attacker-chosen key, and the unauthenticated `/api/plex/oauth/pin` plus `pin/<id>/check` pair lets an attacker bind their own Plex account token to the instance. The root cause is that the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` ships without the per-handler `@authenticate` decorator that all 65 sibling API handlers carry, and no global authentication hook compensates. Every release up to and including 1.5.6 is affected, and the vendor closed the anonymous API-mutation path in 1.5.7-beta.14; the CVE record is scored CVSS 10.0 and the vulnerability carries an act_now priority decision, though no public exploit code was identified at time of analysis. Attackers can additionally abuse attacker-supplied server URLs that are later fetched with the configured API key in an `X-Plex-Token` header, producing server-side request forgery and credential exposure against instances where a Plex integration is already configured.
An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Bazarr manages and downloads subtitles. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Bazarr manages and downloads subtitles. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Bazarr manages and downloads subtitles. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.