jellyfin

no IP in Jellyfin.Api.Auth.CustomAuthenticationHandler: CustomAuthentication was not authenticated. Failure message: Invalid token. enhancement security

#7049 opened 2026-02-07 04:26:38 +03:00 by OVERLORD

1

GetUser() endpoint (UserController) is fully unauthenticated bug security

#6960 opened 2026-02-07 04:19:56 +03:00 by OVERLORD

1

Granular apikey permissions bug security

#6959 opened 2026-02-07 04:19:56 +03:00 by OVERLORD

GetUsers() endpoint (UserController) only requires user privileges bug security

#6958 opened 2026-02-07 04:19:56 +03:00 by OVERLORD

All (raw) image endpoints in ImageByNameController, ImageController & RemoteImageController are unauthenticated bug security

#6957 opened 2026-02-07 04:19:52 +03:00 by OVERLORD

Most endpoints in DashboardController are unauthenticated bug security

#6955 opened 2026-02-07 04:19:50 +03:00 by OVERLORD

"Gets subtitles in a specified format" and "Gets subtitles in a specified format" (SubtitleController) endpoints are unauthenticated bug security

#6954 opened 2026-02-07 04:19:49 +03:00 by OVERLORD

All endpoints in AudioController are unauthenticated bug security

#6953 opened 2026-02-07 04:19:48 +03:00 by OVERLORD

Video streams unauthenticated (VideosController, HlsSegmentController, LiveTVController) bug security

#6952 opened 2026-02-07 04:19:48 +03:00 by OVERLORD

GetAttachment() (VideoAttachmentsController) endpoint is unauthenticated bug security

#6951 opened 2026-02-07 04:19:44 +03:00 by OVERLORD

Authentication and user ids are decoupled bug security

#6949 opened 2026-02-07 04:19:43 +03:00 by OVERLORD

Able to create Admin user with empty password bug confirmed security

#6407 opened 2026-02-07 03:35:56 +03:00 by OVERLORD 5 / 5

1

Require elevation for plugin configuration pages confirmed security

#5652 opened 2026-02-07 02:03:08 +03:00 by OVERLORD

1

Refactor "Copy Stream URL" to not leak the user's session API key security

#5359 opened 2026-02-07 01:43:37 +03:00 by OVERLORD

5

[Issue]: User files can get deleted when transcode/cache/log path is imporoperly set bug security

#4858 opened 2026-02-07 01:13:36 +03:00 by OVERLORD

11

[Issue]: Library Access Settings Not Respected With Merged Media bug security

#4642 opened 2026-02-07 01:02:16 +03:00 by OVERLORD 1 / 1

1

[security] support replay protection for TLS 0-RTT bug enhancement security

#4597 opened 2026-02-07 00:59:15 +03:00 by OVERLORD

3

Roku 1.6 Access controls are broken. Leaking restricted search results. bug security

#4350 opened 2026-02-07 00:45:42 +03:00 by OVERLORD 1 / 1

5

Work towards reducing exposed information from /emby/users/public bug confirmed security

#1736 opened 2026-02-06 21:18:09 +03:00 by OVERLORD

2

Until a new password is set, changing password leaves the user account without a password bug confirmed security

#1430 opened 2026-02-06 20:58:29 +03:00 by OVERLORD

10