CVE-2026-27707 Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint
Unauthenticated attackers can register accounts on Plex-configured Seerr instances via a flawed Jellyfin endpoint, gaining access to submit media requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27707?
CVE-2026-27707 is a high-severity authentication bypass vulnerability in seerr-team seerr, published on 27 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in `POST /api/v1/auth/jellyfin` allows an unauthenticated attacker to register a new Seerr account on any Plex-configured instance by authenticating with an attacker-controlled Jellyfin server. The attacker receives an authenticated session and can immediately use the application with default permissions, including the ability to submit media requests to Radarr/Sonarr. Any Seerr deployment where all three of the following are true may be vulnerable: `settings.main.mediaServerType` is set to `PLEX` (the most common deployment).; `settings.jellyfin.ip` is set to `""` (default, meaning Jellyfin was never configured); and `settings.main.newPlexLogin` is set to `true` (default). Jellyfin-configured and Emby-configured deployments are not affected. Version 3.1.0 of Seerr fixes this issue.
Which versions are affected by CVE-2026-27707?
It affects 1 product.
Products include Seerr Seerr.
How do I fix CVE-2026-27707?
No fix has been published for CVE-2026-27707 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-27707 being exploited?
There is no known exploitation of CVE-2026-27707 in the wild and no public exploit code.
Other vulnerabilities in seerr-team seerr
Sources
Also known as GHSA-rc4w-7m3r-c2f7.