SZB-b489e893c2
CVE-2026-61826 reported as missing authentication in Bazarr Plex OAuth API
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Bazarr
- Product
- Bazarr
- First seen
Summary
CVE-2026-61826 is reported in Bazarr, a companion application to Sonarr and Radarr, with a CVSS score of 10. According to the listing, the api_ns_plex namespace in bazarr/api/plex/oauth.py omits the @authenticate check that other Bazarr APIs require, and the item does not say whether it is being exploited.
If you use Bazarr
Identify any Bazarr instances and their versions
Upgrade Bazarr to 1.5.7-beta.14 or later
Restrict network access to the Bazarr web interface until patched
What the sources say 1
· Mastodon: “Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentica...” Source