An authentication bypass vulnerability in Seerr versions 2.0.0 through 3.0.x allows unauthenticated attackers to create unauthorized accounts, posing a significant risk of unauthorized media management.

This is an authentication bypass and reliance on untrusted inputs vulnerability occurring in the POST /api/v1/auth/jellyfin endpoint. Unauthenticated attackers can exploit a logic flaw to register new accounts on instances where Plex is the primary media server but Jellyfin is left unconfigured.

Successful exploitation allows an attacker to gain an authenticated session with default permissions, enabling them to manipulate media requests and interact with downstream services like Radarr and Sonarr. With a CVSS score of 7.3, this high-severity flaw facilitates unauthorized access to media management workflows, which could lead to resource exhaustion or the unauthorized consumption of media assets, causing potential operational disruption.

Immediate Action: Update Seerr to version 3.1.0 or later immediately to resolve the authentication guard logic flaw.

Proactive Monitoring: Review application access logs for suspicious account registration patterns or unauthorized API requests to the /api/v1/auth/jellyfin endpoint.

Compensating Controls: If immediate patching is not possible, ensure that the Jellyfin server settings are explicitly configured or restricted to prevent the software from falling back to insecure default authentication behaviors.

Public Exploit Available: Unknown.

Given the high severity of this authentication bypass and the ease with which it can be triggered, administrators must prioritize the update to version 3.1.0. Failure to patch leaves the instance exposed to unauthorized account creation, which may be leveraged for further downstream service manipulation.