CVE-2026-61826: Missing Authentication in Bazarr

CVE-2026-61826 in Bazarr: unauthenticated API endpoints allow configuration manipulation.

CVE-2026-61826 identifies a critical authentication flaw in Bazarr, the companion application of Sonarr and Radarr for subtitle management. API endpoints in the Plex namespace lack mandatory authentication protection, while standard APIs require an API key. This allows anyone, even without credentials, to execute sensitive operations such as disabling the Plex integration, setting attacker-controlled API keys, and manipulating the persistent configuration of the service.

The CVSS score is 10.0 critical. An unauthenticated attacker can clear credentials, manipulate configuration including attacker-controlled server URLs, and exploit server-side request forgery to expose the Plex authentication token in outbound requests. Version 1.5.7-beta.14, available since 2026-10-30, closes the anonymous path by adding authentication. On X, 4 reports are logged in 24 hours with consistency on affected version and severity.

If you operate Bazarr, upgrading to 1.5.7-beta.14 or later is imperative. If the instance is accessible from untrusted networks, isolate the service temporarily until patching. Audit access logs for anomalous requests to Plex namespaces without valid authentication; even a single request indicates exposure. Consider exposing Bazarr only behind network authentication (VPN, authenticated proxy) until you have upgraded.

At a glance

What: API endpoints in the Plex namespace of Bazarr in the OAuth management module lack mandatory authentication protection. Unauthenticated users can invoke critical operations to clear credentials, set attacker-controlled API keys, bind attacker-controlled OAuth tokens, manipulate Plex servers and webhooks, compromising integrated configuration and credentials.
Severity: CVSS 10.0 (critical). An unauthenticated attacker can: disable Plex integration by clearing credentials, persist attacker-controlled API keys, bind attacker-controlled OAuth tokens, permanently tamper with configuration, and exploit SSRF to expose the Plex authentication token in outbound requests.
Affected versions: Bazarr prior to 1.5.7-beta.14
Fix: Update to Bazarr 1.5.7-beta.14 or later. The patch adds mandatory authentication to anonymous API-mutation paths. Note: complete OAuth state validation is not yet established and remains a separate residual for later review.
Status: Vulnerability verified by NVD on 2026-10-30. Patch released. Coherent signals on X: 4 posts in 24 hours, all consistent on affected version and severity.
Action: Update immediately to 1.5.7-beta.14 or later. If the instance is exposed on untrusted networks, consider temporary isolation until patching. Review access logs for anomalous requests to Plex namespaces without valid credentials; even one request indicates exposure.

Sources: NVD, CVE-2026-61826

← All articles