CVE-2026-61826

Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...

CVE-2026-61826

In versions prior to 1.5.7-beta.14 , Bazarr is vulnerable to unauthorized configuration tampering and Server-Side Request Forgery (SSRF) . The api_ns_plex namespace in bazarr/api/plex/oauth.py fails to include the @authenticate decorator, allowing anonymous callers to bypass API key requirements....

CVE-2026-61826 Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery

Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...

EUVD-2026-114256

Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...

CVE-2026-61826: morpheus65535 bazarr: Bazarr is a companion application to Sonarr and Radarr

Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the apinsplex namespace in bazarr/api/plex/oauth.py omits @authenticate on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke POST...