CVE-2026-27707

Katalog CVE

CVSS 9.8 · Critical EPSS 0,69%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada seerr. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in `POST /api/v1/auth/jellyfin` allows an unauthenticated attacker to register a new Seerr account on any Plex-configured instance by authenticating with an attacker-controlled Jellyfin server. The attacker receives an authenticated session and can immediately use the application with default permissions, including the ability to submit media requests to Radarr/Sonarr. Any Seerr deployment where all three of the following are true may be vulnerable: `settings.main.mediaServerType` is set to `PLEX` (the most common deployment).; `settings.jellyfin.ip` is set to `""` (default, meaning Jellyfin was never configured); and `settings.main.newPlexLogin` is set to `true` (default). Jellyfin-configured and Emby-configured deployments are not affected. Version 3.1.0 of Seerr fixes this issue.

Rincian

Terbit di NVD

27 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/seerr-team/seerr/security/advisories/GHSA-rc4w-7m3r-c2f7 exploit · advisory vendor
• https://github.com/seerr-team/seerr/commit/4ae20684092b5b28527b23dfbc1a3417858fee8e patch
• https://github.com/seerr-team/seerr/releases/tag/v3.1.0 release notes