All (raw) image endpoints in ImageByNameController, ImageController & RemoteImageController are unauthenticated #6957

Open
opened 2026-02-07 04:19:52 +03:00 by OVERLORD · 0 comments
Owner

Originally created by @felix920506 on GitHub (Apr 23, 2025).

split from #5415

This allows probing on whether a specific image exists on the server by guessing item id's (which can be done without too much trouble, as item ids are based on filepath and filename information) and then checking on what content (movies, series etc) exist on a given server, without having an account.
Potential fix: This is tricky, because the images are loaded by the browser itself, so currently no authentication is provided. Below I propose a new authentication mechanism which would also fix this issue, allowing these endpoints to be authenticated.

Originally created by @felix920506 on GitHub (Apr 23, 2025). split from #5415 This allows probing on whether a specific image exists on the server by guessing item id's (which can be done without too much trouble, as item ids are based on filepath and filename information) and then checking on what content (movies, series etc) exist on a given server, without having an account. Potential fix: This is tricky, because the images are loaded by the browser itself, so currently no authentication is provided. Below I propose a new authentication mechanism which would also fix this issue, allowing these endpoints to be authenticated.
OVERLORD added the bugsecurity labels 2026-02-07 04:19:52 +03:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/jellyfin#6957