[Issue]: Jellyfin binds to all interfaces when using any loopback address other than 127.0.0.1 or [::1] #4978

New Issue

OVERLORD · 2026-02-07T01:21:10+03:00

OVERLORD commented

2026-02-07 01:21:10 +03:00

Originally created by @lucasmz-dev on GitHub (Jul 19, 2023).

Please describe your bug

The title is very self-explanatory, it's pretty much it. If you use any other loopback address in 127.0.0.0/8, like 127.0.0.2 even, Jellyfin seems to believe it's not a valid IP or something, instead, it defaults to binding to every interface.

This caused a security problem for me, I use port 80 and 443, and because it was binding to every interface and IP it saw, it also binded to a bunch of public IPv6 addresses, this usually wouldn't be that big of an issue, however my router is kind of crap and does not have a stateful firewall, and since I trusted Jellyfin with firewall rules, it opened those ports directly to the open web; anyone pasting my IP on their browser would directly get into Jellyfin's page.

I use a reverse proxy because it has a lot of benefits, and I need to host other stuff in the same IP on the web, so I set Jellyfin to use 127.0.1.1, but didn't realize until weeks, maybe a month later what was going on.

Jellyfin Version

10.8.z

if other:

No response

Environment

- OS: Windows 11
- Linux Kernel: none
- Virtualization: none ?
- Clients: Not applicable
- Browser: Not applicable
- FFmpeg Version: Not applicable
- Playback Method: Not applicable
- Hardware Acceleration: Not applicable
- GPU Model: Not applicable
- Plugins: Open Subtitles, Session Cleaner, Skip Intro
- Reverse Proxy: Caddy
- Base URL: 
- Networking: Host (I think?)
- Storage: Not applicable

Jellyfin logs

[2023-07-19 00:42:29.455 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Defined LAN addresses : "[XXXX:XXXX:XXXX:XXXX::/64]"
[2023-07-19 00:42:29.456 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Defined LAN exclusions : "[]"
[2023-07-19 00:42:29.458 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Using LAN addresses: "[XXXX:XXXX:XXXX:XXXX::/64]"
[2023-07-19 00:42:29.465 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Using bind addresses: "[]"
[2023-07-19 00:42:29.466 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Using bind exclusions: "[]"



### FFmpeg logs

_No response_

### Please attach any browser or client logs here

_No response_

### Please attach any screenshots here

_No response_

### Code of Conduct

- [X] I agree to follow this project's Code of Conduct

Originally created by @lucasmz-dev on GitHub (Jul 19, 2023). ### Please describe your bug The title is very self-explanatory, it's pretty much it. If you use any other loopback address in 127.0.0.0/8, like 127.0.0.2 even, Jellyfin seems to believe it's not a valid IP or something, instead, it defaults to binding to every interface. This caused a security problem for me, I use port 80 and 443, and because it was binding to every interface and IP it saw, it also binded to a bunch of public IPv6 addresses, this usually wouldn't be that big of an issue, however my router is kind of crap and does not have a stateful firewall, and since I trusted Jellyfin with firewall rules, it opened those ports directly to the open web; anyone pasting my IP on their browser would directly get into Jellyfin's page. I use a reverse proxy because it has a lot of benefits, and I need to host other stuff in the same IP on the web, so I set Jellyfin to use 127.0.1.1, but didn't realize until weeks, maybe a month later what was going on. ### Jellyfin Version 10.8.z ### if other: _No response_ ### Environment ```markdown - OS: Windows 11 - Linux Kernel: none - Virtualization: none ? - Clients: Not applicable - Browser: Not applicable - FFmpeg Version: Not applicable - Playback Method: Not applicable - Hardware Acceleration: Not applicable - GPU Model: Not applicable - Plugins: Open Subtitles, Session Cleaner, Skip Intro - Reverse Proxy: Caddy - Base URL: - Networking: Host (I think?) - Storage: Not applicable ``` ### Jellyfin logs ```shell [2023-07-19 00:42:29.455 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Defined LAN addresses : "[XXXX:XXXX:XXXX:XXXX::/64]" [2023-07-19 00:42:29.456 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Defined LAN exclusions : "[]" [2023-07-19 00:42:29.458 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Using LAN addresses: "[XXXX:XXXX:XXXX:XXXX::/64]" [2023-07-19 00:42:29.465 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Using bind addresses: "[]" [2023-07-19 00:42:29.466 -03:00] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Using bind exclusions: "[]" ``` ``` ### FFmpeg logs _No response_ ### Please attach any browser or client logs here _No response_ ### Please attach any screenshots here _No response_ ### Code of Conduct - [X] I agree to follow this project's Code of Conduct

OVERLORD added the bug label 2026-02-07 01:21:10 +03:00

OVERLORD closed this issue

2026-02-07 01:21:11 +03:00

OVERLORD commented

2026-02-07 01:21:12 +03:00

@cvium commented on GitHub (Jul 20, 2023):

Duplicate of #6272

@cvium commented on GitHub (Jul 20, 2023): Duplicate of #6272

OVERLORD referenced this issue

2026-02-07 06:18:42 +03:00

[PR #4978] [MERGED] Fixes for multiple proxies #10349

Sign in to join this conversation.

Branches Tags

master

release-10.11.z

renovate/skiasharp-monorepo

JPVenson-patch-1

renovate/morestachio-5.x

release-10.9.z

openapi-cache

release-10.10.z

explicit-load

explicit-load-v2

feature/entity-framework

only-count-folder-item

fix/ci-workflow-refactor

release-10.8.z

release-10.7.z

EraYaN-add-management-interface

release-10.6.z

release-10.5.z

release-10.4.z

release-10.3.z

release-10.2.z

release-10.1.0

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/jellyfin#4978