CVE-2026-27707: Seerr account registration bypass via Jellyfin auth endpoint on Plex instances

Overview

Seerr is an open-source media request and discovery manager used with Jellyfin, Plex and Emby. The GitHub security advisory describes an authentication guard logic flaw in the Jellyfin login endpoint that affects Plex-configured instances under default settings. The record classifies the weakness as CWE-288, Authentication Bypass Using an Alternate Path or Channel.

Impact

According to the record, an unauthenticated attacker can obtain a Seerr account and an authenticated session with default permissions, which can be used to submit media requests to Radarr and Sonarr. NVD assigns a base score of 9.8 (critical), while the GitHub score in the record is 7.3. The SSVC fields list exploitation as none, automatable as yes and technical impact as partial.

Affected products and versions

• Seerr from 2.0.0 up to before 3.1.0, as listed under the product names Seerr Seerr and Seerr-team Seerr.
• Deployments are described as potentially vulnerable only when all three conditions hold: mediaServerType set to PLEX, jellyfin.ip empty, and newPlexLogin set to true.
• Jellyfin-configured and Emby-configured deployments are stated as not affected.

Exploitation status

The record shows kev.listed as false, so no active exploitation is recorded in the CISA KEV catalog. One reference is tagged as an exploit in the CVE data, but the sources consulted do not confirm exploitation in the wild. The EPSS probability in the record is 0.00702, with a percentile of 0.52727.

Remediation and mitigation

• Upgrade Seerr to 3.1.0 or later, the fixed release identified in the record. The fix commit and the release notes are referenced by the record.
• Until the upgrade is applied, check whether the three configuration conditions apply to the deployment. If they do, treat the instance as exposed.
• Limit network exposure of the Seerr interface to trusted users, since the flaw is described as reachable without authentication.
• Review recently created accounts and their permissions for registrations that were not expected.

Detection guidance

• Compare the list of user accounts against expected users and look for accounts created without administrator action.
• If logs are available, review successful authentication events on the Jellyfin login path for sources that are unfamiliar.
• Confirm the configured media server type and Jellyfin settings, since the exposure depends on them.

Limitations of the available information

• The record does not describe exact log signatures, and this analysis relies on the advisory summary rather than on a review of the fix commit.
• NVD and GitHub assign different CVSS base scores (9.8 and 7.3).
• The record does not state whether any deployment has been compromised, so the extent of real-world impact is unknown.
• No configuration-only workaround is stated in the record, so upgrading is the only fix documented in the sources.

Frequently asked questions

Which Seerr versions are affected?

According to the record, Seerr versions from 2.0.0 up to before 3.1.0 are affected under the stated configuration conditions.

Does the flaw affect every Seerr installation?

No. The record says a deployment may be vulnerable only when mediaServerType is PLEX, jellyfin.ip is empty, and newPlexLogin is true. Jellyfin-configured and Emby-configured deployments are stated as not affected.

Is there confirmed exploitation in the wild?

The record shows kev.listed as false and the sources consulted do not confirm active exploitation. One reference is tagged as an exploit, but that does not confirm exploitation in the wild.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.