A critical authentication bypass in Sonarr allows unauthenticated attackers to gain unauthorized access to the application if the authentication setting is configured to be disabled for local addresses.

This vulnerability is an authentication bypass (CWE-290) stemming from improper handling of headers when Sonarr is configured with Authentication Required set to Disabled for Local Addresses. Unauthenticated attackers can exploit this flaw to bypass security controls if the application is not protected by a reverse proxy that validates headers or if it is exposed directly to the internet.

Successful exploitation allows unauthorized actors to gain full access to the Sonarr interface, potentially leading to data compromise or unauthorized modification of PVR settings. With a CVSS score of 8.1, this high-severity vulnerability poses a significant risk to organizations that expose their PVR instances to untrusted networks, as it effectively removes all access barriers for remote attackers.

Immediate Action: Upgrade to version 4.0.16.2944 (stable) or 4.0.16.2942 (nightly/develop) immediately to resolve the flaw.

Proactive Monitoring: Review access logs for unusual traffic patterns originating from unexpected IP addresses, especially if the application is intended to be restricted to local network traffic.

Compensating Controls: If patching is not immediately feasible, set the Authentication Required configuration to Enabled, place the application behind a secure reverse proxy, or restrict access to the application via a VPN or private network overlay like Tailscale.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of the vulnerability, administrators should prioritize updating their Sonarr instances to the provided fixed versions. If the application must remain accessible, ensure that Authentication Required is strictly set to Enabled and that the instance is not directly exposed to the public internet without additional layers of authentication or network-level access control.