We have recently experienced a security incident that may potentially involve your Plex account information. We believe the actual impact of this incident is limited; however, action is required from you to ensure your account remains secure.
What happened
An unauthorized third party accessed a limited subset of customer data from one of our databases. While we quickly contained the incident, information that was accessed included emails, usernames, securely hashed passwords and authentication data.
Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. Out of an abundance of caution, we recommend you take some additional steps to secure your account (see details below). Rest assured that we do not store credit card data on our servers, so this information was not compromised in this incident.
What we’re doing
We’ve already addressed the method that this third party used to gain access to the system, and we’re undergoing additional reviews to ensure that the security of all of our systems is further strengthened to prevent future attacks.
What you must do
If you use a password to sign into Plex: We kindly request that you reset your Plex account password immediately by visiting https://plex.tv/reset. When doing so, there’s a checkbox to “Sign out connected devices after password change,” which we recommend you enable. This will sign you out of all your devices (including any Plex Media Server you own) for your security, and you will then need to sign back in with your new password.
If you use SSO to sign into Plex: We kindly request that you log out of all active sessions by visiting https://plex.tv/security and clicking the button that says ”Sign out of all devices”. This will sign you out of all your devices (including any Plex Media Server you own) for your security, and you will then need to sign back in as normal.
Additional Security Measures You Can Take
We remind you that no one at Plex will ever reach out to you over email to ask for a password or credit card number for payments. For further account protection, we also recommend enabling two-factor authentication on your Plex account if you haven’t already done so.
Lastly, we sincerely apologize for any inconvenience this situation may cause you. We take pride in our security systems, which helped us quickly detect this incident, and we want to assure you that we are working swiftly to prevent potential future incidents from occurring.
For step-by-step instructions on how to reset your password, visit:https://support.plex.tv/articles/account-requires-password-reset
You don't even have to hack jellyfin though. Quite a few endpoints aren't behind authentication at all.
But that doesn't help your case so I'm sure you'll just downvote me.
Edit: For those who don't know. https://github.com/jellyfin/jellyfin/issues/5415
Several issues. Some require being logged in with any account (to get other user information on the server, including admin)... others are endpoints that let media access if you guess a guessable md5 hash(which is normalized in docker setups in general... and standardized by *arr setups. So highly guessable if you use these tools... which most of you are). The sort of thing that media companies will absolutely abuse eventually if they're not already doing it to collect proof that you're hosting their content illegally. But I just find it laughable that this is the answer... but ya'll are frothing at the mouth over plex leaking an email address... Oh no! not the email address you already get boatloads of spam at! However will you live!
Personally I wish I could just make authentication optional on my jellyfin just like it is for peertube and funkwhale.
That would be a perfectly valid answer... But the Devs have posted several times that they're not interested in resolving it.
I'd accept a checkbox on install of Jellyfin for "Check this box for better security... some unsupported software might not like this. Go to Options/blah/blah to change this later if you need to change this later."
I'd probably shut the fuck up about this whole thing and dump Plex. But every single time Plex ends up in an article there's people singing praises about Jellyfin when there's completely open endpoints... It just baffles me. Downvotes be damned, I'll bring it up though when I see it since the devs won't bother telling people their software has a potentially big problem (especially if you use default configs, docker, and *arr stacks).
Sure you always seem like a shill. You might not be but it comes across. Plex is not perfect either and has had breaches and been used to hack someones machine. As far as I know jellyfish has bit been used in that space and these issues could not be used for that.
That person was using a horrifically out of date version of the plex server with known, documented, and already patched vulnerabilities.