Authentication Bypass Vulnerability in Bazarr Integrated with Plex

CVE-2026-61826

What is CVE-2026-61826?

Bazarr, used alongside Sonarr and Radarr, has an authentication vulnerability that allows unauthorized access to its API. Versions before 1.5.7-beta.14 lack necessary authentication measures in the api_ns_plex namespace, enabling anonymous attackers to execute sensitive API calls. This can lead to credential manipulation and server-side request forgery. Attackers can invoke endpoints such as POST /api/plex/oauth/logout to clear credentials or create persistent configurations, potentially compromising integrations with Plex. While version 1.5.7-beta.14 introduces authentication mechanisms, residual issues, such as incomplete OAuth state validation, require attention to fully secure the API.

References