CVE-2026-61826 - Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
CVE ID :CVE-2026-61826 Published : Oct. 30, 2026, 5:17 p.m. | 43 minutes ago Description :Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs...