ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27707

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby.

Published Feb 27, 2026 · updated Jun 17, 2026 · seerr seerr

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in allows an unauthenticated attacker to register a new Seerr account on any Plex-configured instance by authenticating with an attacker-controlled Jellyfin server. The attacker receives an authenticated session and can immediately use the application with default permissions, including the ability to submit media requests to Radarr/Sonarr. Any Seerr deployment where all three of the following are true may be vulnerable: is set to (the most common deployment).; is set to (default, meaning Jellyfin was never configured); and is set to (default). Jellyfin-configured and Emby-configured deployments are not affected. Version 3.1.0 of Seerr fixes this issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 27, 2026 · NIST NVD

    Detected

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in allows an unauthenticated attacker to register a new Seerr account on any Plex-configured instance by authenticating with an attacker-controlled Jellyfin server. The attacker receives an authenticated session and can i

  2. Jun 17, 2026 · NIST NVD

    Updated

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in allows an unauthenticated attacker to register a new Seerr account on any Plex-configured instance by authenticating with an attacker-controlled Jellyfin server. The attacker receives an authenticated session and can i

Affected

  • cpe seerr/seerrversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-27707

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-27707

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in allows an unauthenticated attacker to register a new Seerr account on

    nvd.nist.gov

References