External risk intelligence

Bazarr API Authentication Bypass Enables Configuration Tampering and Server-Side Request Forgery

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-61826

Bazarr is a web-based companion application commonly deployed to manage media services. While it is often hosted on a local network, it is frequently exposed to the internet via reverse proxies or VPNs to allow remote access for management, or is configured as a public-facing web service to integrate with external media APIs. Given its role as a persistent, network-accessible management web interface, public internet reachability is common.

Cross-site Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Bazarr, a media management application. The issue allows unauthenticated attackers to bypass security controls to modify application settings, disable integrations, or even inject malicious configuration, potentially leading to unauthorized access and control of the Bazarr instance. The main concern is confirming relevance and exposure.

Unauthenticated attackers can alter critical settings.
It impacts media management applications connected to Plex.
Confirm if Bazarr is used and accessible externally.

Attack Path

How an attacker could exploit the issue

An attacker can reach Bazarr's vulnerable API endpoints over the network without needing any prior authentication. By sending specially crafted requests, an attacker can manipulate configuration settings, disable integrations, or even inject their own credentials to gain unauthorized access and control over the Bazarr instance. This could lead to server-side request forgery or exposure of sensitive API keys.

No authentication required for access.
Triggered by API calls to `oauth.py`.
Allows configuration tampering and credential exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to manipulate Bazarr's configuration and integrations with services like Plex. Attackers could potentially disable existing integrations, add their own credentials to access connected services, or redirect Bazarr to malicious servers, leading to unauthorized access or service disruption.

Configuration data and service integrations.
Anonymous API endpoints accessible remotely.
Unauthorized access and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Bazarr application's API lacks proper authentication, allowing unauthenticated users to alter critical configurations, disable integrations, or even inject malicious Plex accounts. The first practical step involves identifying all Bazarr instances, assessing their exposure and business criticality, and locating the accountable owner to plan remediation.

Application owners should lead remediation efforts.
Verify anonymous API endpoint reachability.
Plan for configuration reset and re-integration.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Bazarr?

Bazarr is a companion application widely used to automate subtitle downloading and management for media libraries. It integrates directly with services like Sonarr and Radarr to organize and synchronize media files. Because it serves as a management interface for these systems, it is often configured to communicate with external media APIs like Plex to coordinate service settings and configuration data.

What does CVE-2026-61826 mean for security?

This vulnerability is an authentication bypass involving missing access controls. In plain English, the application fails to verify who is making a request to specific API endpoints. This allows an unauthorized person to perform actions meant for administrators, such as modifying configuration settings, injecting their own API keys, or manipulating how the application connects to other media services.

How is this vulnerability triggered?

An attacker triggers this by sending unauthorized requests directly to specific API endpoints within the application's Plex OAuth component. No special preconditions, such as existing accounts, PINs, or pre-established state, are required to initiate these commands. The bug is not triggered by standard, authenticated user activity, but specifically through these open, unprotected API paths.

Is my instance at risk?

If you host Bazarr, you should assume risk if the service is reachable over the network. According to Halo Surface Signal, because Bazarr is frequently deployed behind reverse proxies or configured as a public-facing service for remote management, it is often internet-accessible. Even if intended for local use, external reachability significantly increases the possibility of an unauthorized party interacting with these vulnerable API endpoints.

What should I do first to address this?

Begin by identifying all running instances of Bazarr in your environment to determine which are accessible over the network. Once located, consult with the application owner to evaluate your exposure and prioritize updating to version 1.5.7-beta.14 or later, which introduces necessary authentication checks. Additionally, plan to review and reset any configurations or service integrations that may have been tampered with.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.