Sonarr versions older than 4.0.16.2942 allow an unauthenticated attacker to bypass the login mechanism when the application is configured to disable authentication for local addresses and no reverse proxy is in place. The flaw permits the attacker to access the web interface as a fully authenticated user, enabling the use of all administrative functions without providing valid credentials.

The affected product is Sonarr, with all releases prior to version 4.0.16.2942 vulnerable. The issue is resolved by upgrading to the nightly build 4.0.16.2942 or to the stable release 4.0.16.2944 and later.

The CVSS score of 8.1 indicates high severity, while the EPSS probability of less than 1 % suggests a low likelihood of exploitation in the field. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is over HTTP by sending requests that do not present authenticating credentials to an exposed Sonarr instance that has disabled local‑address authentication; if the service is not directly reachable from the internet, the risk is mitigated but misconfigured reverse proxies could still expose the surface.