PT-2026-22380 · Seerr+5 · Seerr+5

Mandreko · Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-27707

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Seerr versions 2.0.0 through 3.0.9

Description Seerr is a media request and discovery manager for Jellyfin, Plex, and Emby. A flaw in the authentication guard logic within the /api/v1/auth/jellyfin API endpoint allows an unauthenticated attacker to create a new Seerr account on any Plex-configured instance. This is achieved by authenticating with an attacker-controlled Jellyfin server, granting the attacker an authenticated session with default permissions, including the ability to submit media requests to Radarr/Sonarr. Deployments where settings.main.mediaServerType is set to PLEX, settings.jellyfin.ip is set to "", and settings.main.newPlexLogin is set to true are potentially vulnerable.

Recommendations Update to Seerr version 3.1.0 or later.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

CWE-807

Related Identifiers

CVE-2026-27707

GHSA-RC4W-7M3R-C2F7

Affected Products

Emby

Jellyfin

Plex

Readarr

Seerr

Sonarr

References · 10

• 🔥 https://github.com/seerr-team/seerr/security/advisories/GHSA-rc4w-7m3r-c2f7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27707.json · Exploit
• https://github.com/seerr-team/seerr/commit/4ae20684092b5b28527b23dfbc1a3417858fee8e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27707 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27707 · Vendor Advisory
• https://github.com/seerr-team/seerr/releases/tag/v3.1.0 · Note
• https://t.me/cveNotify/154142 · Telegram Post
• https://t.me/cveNotify/154145 · Telegram Post
• https://twitter.com/CVEnew/status/2027744256182407664 · Twitter Post
• https://twitter.com/cracbot/status/2029150058193846709 · Twitter Post