starred/jellyfin
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.git synced 2026-07-16 05:43:54 +03:00
Code Issues 822 Packages Projects Releases 17 Wiki Activity

Able to create Admin user with empty password #6407

New Issue
Open
opened 2026-02-07 03:35:56 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-07 03:35:56 +03:00
Owner
Copy Link

Originally created by @LePips on GitHub (Oct 31, 2024).

This issue respects the following points:

  • This is a bug, not a question or a configuration issue; Please visit our forum or chat rooms first to troubleshoot with volunteers, before creating a report. The links can be found here.
  • This issue is not already reported on GitHub (I've searched it).
  • I'm using an up to date version of Jellyfin Server stable, unstable or master; We generally do not support previous older versions. If possible, please update to the latest version before opening an issue.
  • I agree to follow Jellyfin's Code of Conduct.
  • This report addresses only a single issue; If you encounter multiple issues, kindly create separate reports for each one.

Description of the bug

The server has moved to forbidding admin users with empty passwords when changing user passwords, however you can create a user that isn't an admin with an empty password and then make them an admin.

Tested on 10.9 and 10.10.

Reproduction steps

1 - Create normal user with empty password
2 - Update user policy IsAdministrator to true, or Allow this user to manage the server in web
3 - Now user with empty password is admin

What is the current bug behavior?

An admin with empty password is allowed.

What is the expected correct behavior?

Probably an error, but I am honestly unsure of how to properly check this condition without looking at the password on server.

Jellyfin Server version

10.10.0+

Specify commit id

No response

Specify unstable release number

No response

Specify version number

No response

Specify the build version

10.10.0

Environment

N/A, is API issue.

Jellyfin logs

Get 200 🤷

FFmpeg logs

No response

Client / Browser logs

No response

Relevant screenshots or videos

No response

Additional information

No response

Originally created by @LePips on GitHub (Oct 31, 2024). ### This issue respects the following points: - [x] This is a **bug**, not a question or a configuration issue; Please visit our forum or chat rooms first to troubleshoot with volunteers, before creating a report. The links can be found [here](https://jellyfin.org/contact/). - [x] This issue is **not** already reported on [GitHub](https://github.com/jellyfin/jellyfin/issues?q=is%3Aopen+is%3Aissue) _(I've searched it)_. - [x] I'm using an up to date version of Jellyfin Server stable, unstable or master; We generally do not support previous older versions. If possible, please update to the latest version before opening an issue. - [x] I agree to follow Jellyfin's [Code of Conduct](https://jellyfin.org/docs/general/community-standards.html#code-of-conduct). - [x] This report addresses only a single issue; If you encounter multiple issues, kindly create separate reports for each one. ### Description of the bug The server has moved to forbidding admin users with empty passwords when changing user passwords, however you can create a user that isn't an admin with an empty password and _then_ make them an admin. Tested on 10.9 and 10.10. ### Reproduction steps 1 - Create normal user with empty password 2 - Update user policy `IsAdministrator` to true, or `Allow this user to manage the server` in web 3 - Now user with empty password is admin ### What is the current _bug_ behavior? An admin with empty password is allowed. ### What is the expected _correct_ behavior? Probably an error, but I am honestly unsure of how to properly check this condition without looking at the password on server. ### Jellyfin Server version 10.10.0+ ### Specify commit id _No response_ ### Specify unstable release number _No response_ ### Specify version number _No response_ ### Specify the build version 10.10.0 ### Environment N/A, is API issue. ### Jellyfin logs Get 200 :shrug: ### FFmpeg logs _No response_ ### Client / Browser logs _No response_ ### Relevant screenshots or videos _No response_ ### Additional information _No response_
OVERLORD added the bugconfirmedsecurity labels 2026-02-07 03:35:56 +03:00
OVERLORD commented 2026-02-07 03:35:58 +03:00
Author
Owner
Copy Link

@nielsvanvelzen commented on GitHub (Nov 1, 2024):

The server does know when a password is empty, so returning an error is possible.

@nielsvanvelzen commented on GitHub (Nov 1, 2024): The server does know when a password is empty, so returning an error is possible.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
EFjellyfin.db
area:database
awaiting-feedback
backend
blocked
breaking change: web api
bug
build
ci
confirmed
discussion needed
dotnet future
downstream
duplicate
enhancement
feature
future
github-actions
good first issue
hdr
help wanted
invalid
investigation
librarydb
live-tv
lyrics
media playback
music
needs testing
nuget
performance
platform
pull-request
Mirrored from GitHub Pull Request
 question
regression
release critical
requires-web
roadmap
security
security
stale
support
syncplay
ui & ux
upstream
wontfix
No Label bug confirmed security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/jellyfin#6407
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?