An unsanitized JSONP callback parameter in Tautulli allows a malicious actor to inject arbitrary JavaScript into a response that other sites can execute, thereby enabling cross‑origin script injection. Because the API key is included in the JSONP payload, this technique can also lead to theft of privileged credentials that can be used to control the Plex Media Server. The weakness is a classic reflected input vulnerability and is classified as CWE‑79.

The vulnerability exists in Tautulli versions from 1.3.10 up to, but not including, 2.17.0. Users running any of those releases with the JSONP API endpoint enabled are affected.

The CVSS score of 7.4 indicates high severity, but the EPSS score of less than one percent suggests that exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread attacks yet. The likely attack path requires an attacker to host a malicious web page that calls the vulnerable JSONP endpoint, causing a victim to visit the page. The exploitation vector is therefore client‑side via a crafted URL, and requires a victim to load the payload in a web browser.