[PR #15892] [CLOSED] [Security] Fix HIGH vulnerability: V-001 #14450

New Issue

OVERLORD · 2026-02-07T07:30:01+03:00

OVERLORD commented

2026-02-07 07:30:01 +03:00

📋 Pull Request Information

Original PR: https://github.com/jellyfin/jellyfin/pull/15892
Author: @orbisai0security
Created: 12/30/2025
Status: ❌ Closed

Base: master ← Head: fix-v-001-jellyfin.server.implementations-cryptography-pbkdf2passwordhasher.cs

📝 Commits (1)

1ee1501 fix: resolve high vulnerability V-001

📊 Changes

1 file changed (+7 additions, -1 deletions)

View changed files

📝 Emby.Server.Implementations/Cryptography/CryptographyProvider.cs (+7 -1)

📄 Description

Security Fix

This PR addresses a HIGH severity vulnerability detected by our security scanner.

Security Impact Assessment

Aspect	Rating	Rationale
Impact	High	In Jellyfin, a media server where user accounts control access to personal media libraries and administrative functions, weak password hashing could allow attackers to crack passwords offline if the hash database is compromised, leading to unauthorized account takeovers and potential exposure of sensitive media content or server controls.
Likelihood	Medium	Jellyfin is typically self-hosted on personal or home networks, reducing exposure to external attackers, but if deployed with poor security practices like weak network configs or exposed APIs, hash theft could occur via targeted attacks; however, it requires insider access or specific vulnerabilities to obtain the hashes first.
Ease of Fix	Medium	Remediation involves updating the Pbkdf2PasswordHasher.cs file to increase iterations to at least 100,000 and switch to a stronger hash like SHA256, requiring code changes, potential migration logic for existing hashes, and moderate testing to ensure compatibility without breaking authentication flows.

Evidence: Proof-of-Concept Exploitation Demo

⚠️ For Educational/Security Awareness Only

This demonstration shows how the vulnerability could be exploited to help you understand its severity and prioritize remediation.

How This Vulnerability Can Be Exploited

The PBKDF2 password hashing in Jellyfin uses only 10,000 iterations with the deprecated SHA1 algorithm, making it vulnerable to offline cracking attacks if an attacker obtains the password hashes from the database. An attacker could use GPU-accelerated tools like Hashcat to brute-force or dictionary-attack these hashes efficiently, potentially recovering user passwords in hours or days depending on password complexity. This demonstrates the real-world exploitability in Jellyfin's context, where user credentials are stored in a database (e.g., SQLite or PostgreSQL) and could be exposed via SQL injection, misconfigured access, or other breaches.

# Proof-of-Concept: Offline Password Cracking Demonstration
# This simulates an attacker who has obtained Jellyfin password hashes from a compromised database.
# Jellyfin stores passwords in the database using PBKDF2-SHA1 with 10,000 iterations, as per Pbkdf2PasswordHasher.cs.
# Prerequisites: Attacker has access to the database (e.g., via SQL injection in Jellyfin's API or misconfigured DB exposure).
# Tools needed: Hashcat (GPU-accelerated cracker), a sample hash from Jellyfin (format: PBKDF2-SHA1).

# Step 1: Extract a sample hash from Jellyfin's database (simulated example).
# In a real scenario, query the database: SELECT * FROM Users WHERE Id = <user_id>;
# Hash format in Jellyfin: pbkdf2_sha1$10000$<salt>$<hash> (based on the code in Pbkdf2PasswordHasher.cs).
# Example hash (for demo; replace with real extracted hash): pbkdf2_sha1$10000$abcdefghijklmnop$hashedvalue

# Step 2: Prepare a wordlist or mask for cracking (e.g., common passwords or brute-force).
# Create a simple wordlist file: echo -e "password\n123456\nadmin\njellyfin" > wordlist.txt

# Step 3: Use Hashcat to crack the hash.
# Hashcat mode for PBKDF2-SHA1: -m 120 (PBKDF2-HMAC-SHA1).
# This can be run on a GPU-enabled machine; cracking a weak password might take minutes to hours.
hashcat -m 120 -a 0 pbkdf2_sha1\$10000\$abcdefghijklmnop\$hashedvalue wordlist.txt --force

# Expected output: If the password is in the wordlist (e.g., "password"), Hashcat will recover it quickly.
# For brute-force on short passwords: hashcat -m 120 -a 3 pbkdf2_sha1\$10000\$abcdefghijklmnop\$hashedvalue ?a?a?a?a?a?a --force
# With 10,000 iterations, this is feasible on consumer GPUs (e.g., RTX 3080 can try billions of combinations per second).

# Step 4: Once cracked, use the recovered password to log in to Jellyfin via its web interface or API.
# Example API login (using curl, assuming Jellyfin runs on localhost:8096):
curl -X POST http://localhost:8096/Users/AuthenticateByName \
  -H "Content-Type: application/json" \
  -d '{"Username": "victim_user", "Pw": "cracked_password"}'
# Success indicates account takeover, allowing access to media libraries, admin functions, etc.

Exploitation Impact Assessment

Impact Category	Severity	Description
Data Exposure	High	Exposure of all user passwords in Jellyfin's database (e.g., SQLite or PostgreSQL), enabling offline cracking to reveal plaintext credentials. This could leak access to personal media libraries, potentially including sensitive user data like watch history or shared content, and allow pivoting to other accounts if passwords are reused.
System Compromise	Medium	Cracked passwords grant user-level access to Jellyfin accounts, allowing API abuse or web interface control. While not directly enabling code execution or root access, it could lead to privilege escalation if combined with other vulnerabilities (e.g., API flaws for admin takeover), but full system compromise requires additional steps like exploiting the host OS.
Operational Impact	Low	No direct service disruption from cracking alone, but successful account takeovers could lead to resource exhaustion (e.g., excessive media streaming) or data corruption (e.g., deleting libraries). Jellyfin's media serving could be indirectly impacted if many accounts are compromised, but the core service remains available.
Compliance Risk	High	Violates OWASP Top 10 (A02:2021 - Cryptographic Failures) and could breach GDPR (Article 32: security of processing) if user data is exposed in EU contexts. Fails NIST password guidelines (SP 800-63B recommends PBKDF2 with at least 10,000 iterations but stronger algorithms), risking audit failures for media platforms handling personal content.

Vulnerability Details

Rule ID: V-001
File: Jellyfin.Server.Implementations/Cryptography/Pbkdf2PasswordHasher.cs
Description: The PBKDF2 password hashing implementation uses an insufficient number of iterations (10,000) and a deprecated hash algorithm (SHA1). This configuration is not resistant to modern offline password cracking attacks using GPUs, placing user credentials at significant risk if the hash database is compromised.

Changes Made

This automated fix addresses the vulnerability by applying security best practices.

Files Modified

Emby.Server.Implementations/Cryptography/CryptographyProvider.cs

Verification

This fix has been automatically verified through:

✅ Build verification
✅ Scanner re-scan
✅ LLM code review

🤖 This PR was automatically generated.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/jellyfin/jellyfin/pull/15892 **Author:** [@orbisai0security](https://github.com/orbisai0security) **Created:** 12/30/2025 **Status:** ❌ Closed **Base:** `master` ← **Head:** `fix-v-001-jellyfin.server.implementations-cryptography-pbkdf2passwordhasher.cs` --- ### 📝 Commits (1) - [`1ee1501`](https://github.com/jellyfin/jellyfin/commit/1ee150155294ab25439d7a03b098f90f4e3067f3) fix: resolve high vulnerability V-001 ### 📊 Changes **1 file changed** (+7 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `Emby.Server.Implementations/Cryptography/CryptographyProvider.cs` (+7 -1) </details> ### 📄 Description ## Security Fix This PR addresses a **HIGH** severity vulnerability detected by our security scanner. ### Security Impact Assessment | Aspect | Rating | Rationale | |--------|--------|-----------| | Impact | High | In Jellyfin, a media server where user accounts control access to personal media libraries and administrative functions, weak password hashing could allow attackers to crack passwords offline if the hash database is compromised, leading to unauthorized account takeovers and potential exposure of sensitive media content or server controls. | | Likelihood | Medium | Jellyfin is typically self-hosted on personal or home networks, reducing exposure to external attackers, but if deployed with poor security practices like weak network configs or exposed APIs, hash theft could occur via targeted attacks; however, it requires insider access or specific vulnerabilities to obtain the hashes first. | | Ease of Fix | Medium | Remediation involves updating the Pbkdf2PasswordHasher.cs file to increase iterations to at least 100,000 and switch to a stronger hash like SHA256, requiring code changes, potential migration logic for existing hashes, and moderate testing to ensure compatibility without breaking authentication flows. | ### Evidence: Proof-of-Concept Exploitation Demo **⚠️ For Educational/Security Awareness Only** This demonstration shows how the vulnerability could be exploited to help you understand its severity and prioritize remediation. #### How This Vulnerability Can Be Exploited The PBKDF2 password hashing in Jellyfin uses only 10,000 iterations with the deprecated SHA1 algorithm, making it vulnerable to offline cracking attacks if an attacker obtains the password hashes from the database. An attacker could use GPU-accelerated tools like Hashcat to brute-force or dictionary-attack these hashes efficiently, potentially recovering user passwords in hours or days depending on password complexity. This demonstrates the real-world exploitability in Jellyfin's context, where user credentials are stored in a database (e.g., SQLite or PostgreSQL) and could be exposed via SQL injection, misconfigured access, or other breaches. The PBKDF2 password hashing in Jellyfin uses only 10,000 iterations with the deprecated SHA1 algorithm, making it vulnerable to offline cracking attacks if an attacker obtains the password hashes from the database. An attacker could use GPU-accelerated tools like Hashcat to brute-force or dictionary-attack these hashes efficiently, potentially recovering user passwords in hours or days depending on password complexity. This demonstrates the real-world exploitability in Jellyfin's context, where user credentials are stored in a database (e.g., SQLite or PostgreSQL) and could be exposed via SQL injection, misconfigured access, or other breaches. ```bash # Proof-of-Concept: Offline Password Cracking Demonstration # This simulates an attacker who has obtained Jellyfin password hashes from a compromised database. # Jellyfin stores passwords in the database using PBKDF2-SHA1 with 10,000 iterations, as per Pbkdf2PasswordHasher.cs. # Prerequisites: Attacker has access to the database (e.g., via SQL injection in Jellyfin's API or misconfigured DB exposure). # Tools needed: Hashcat (GPU-accelerated cracker), a sample hash from Jellyfin (format: PBKDF2-SHA1). # Step 1: Extract a sample hash from Jellyfin's database (simulated example). # In a real scenario, query the database: SELECT * FROM Users WHERE Id = <user_id>; # Hash format in Jellyfin: pbkdf2_sha1$10000$<salt>$<hash> (based on the code in Pbkdf2PasswordHasher.cs). # Example hash (for demo; replace with real extracted hash): pbkdf2_sha1$10000$abcdefghijklmnop$hashedvalue # Step 2: Prepare a wordlist or mask for cracking (e.g., common passwords or brute-force). # Create a simple wordlist file: echo -e "password\n123456\nadmin\njellyfin" > wordlist.txt # Step 3: Use Hashcat to crack the hash. # Hashcat mode for PBKDF2-SHA1: -m 120 (PBKDF2-HMAC-SHA1). # This can be run on a GPU-enabled machine; cracking a weak password might take minutes to hours. hashcat -m 120 -a 0 pbkdf2_sha1\$10000\$abcdefghijklmnop\$hashedvalue wordlist.txt --force # Expected output: If the password is in the wordlist (e.g., "password"), Hashcat will recover it quickly. # For brute-force on short passwords: hashcat -m 120 -a 3 pbkdf2_sha1\$10000\$abcdefghijklmnop\$hashedvalue ?a?a?a?a?a?a --force # With 10,000 iterations, this is feasible on consumer GPUs (e.g., RTX 3080 can try billions of combinations per second). # Step 4: Once cracked, use the recovered password to log in to Jellyfin via its web interface or API. # Example API login (using curl, assuming Jellyfin runs on localhost:8096): curl -X POST http://localhost:8096/Users/AuthenticateByName \ -H "Content-Type: application/json" \ -d '{"Username": "victim_user", "Pw": "cracked_password"}' # Success indicates account takeover, allowing access to media libraries, admin functions, etc. ``` #### Exploitation Impact Assessment | Impact Category | Severity | Description | |-----------------|----------|-------------| | Data Exposure | High | Exposure of all user passwords in Jellyfin's database (e.g., SQLite or PostgreSQL), enabling offline cracking to reveal plaintext credentials. This could leak access to personal media libraries, potentially including sensitive user data like watch history or shared content, and allow pivoting to other accounts if passwords are reused. | | System Compromise | Medium | Cracked passwords grant user-level access to Jellyfin accounts, allowing API abuse or web interface control. While not directly enabling code execution or root access, it could lead to privilege escalation if combined with other vulnerabilities (e.g., API flaws for admin takeover), but full system compromise requires additional steps like exploiting the host OS. | | Operational Impact | Low | No direct service disruption from cracking alone, but successful account takeovers could lead to resource exhaustion (e.g., excessive media streaming) or data corruption (e.g., deleting libraries). Jellyfin's media serving could be indirectly impacted if many accounts are compromised, but the core service remains available. | | Compliance Risk | High | Violates OWASP Top 10 (A02:2021 - Cryptographic Failures) and could breach GDPR (Article 32: security of processing) if user data is exposed in EU contexts. Fails NIST password guidelines (SP 800-63B recommends PBKDF2 with at least 10,000 iterations but stronger algorithms), risking audit failures for media platforms handling personal content. | ### Vulnerability Details - **Rule ID**: `V-001` - **File**: `Jellyfin.Server.Implementations/Cryptography/Pbkdf2PasswordHasher.cs` - **Description**: The PBKDF2 password hashing implementation uses an insufficient number of iterations (10,000) and a deprecated hash algorithm (SHA1). This configuration is not resistant to modern offline password cracking attacks using GPUs, placing user credentials at significant risk if the hash database is compromised. ### Changes Made This automated fix addresses the vulnerability by applying security best practices. ### Files Modified - `Emby.Server.Implementations/Cryptography/CryptographyProvider.cs` ### Verification This fix has been automatically verified through: - ✅ Build verification - ✅ Scanner re-scan - ✅ LLM code review 🤖 This PR was automatically generated. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-07 07:30:01 +03:00

OVERLORD closed this issue

2026-02-07 07:30:02 +03:00

Sign in to join this conversation.

Branches Tags

master

renovate/major-skiasharp-monorepo

renovate/sharpcompress-0.x

renovate/svg.skia-5.x

renovate/ghcr.io-devcontainers-features-docker-in-docker-4.x

release-10.11.z

standards-fix

release-10.9.z

openapi-cache

release-10.10.z

explicit-load

explicit-load-v2

feature/entity-framework

only-count-folder-item

fix/ci-workflow-refactor

release-10.8.z

release-10.7.z

EraYaN-add-management-interface

release-10.6.z

release-10.5.z

release-10.4.z

release-10.3.z

release-10.2.z

release-10.1.0

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/jellyfin#14450