The Bazarr companion application exposes a Plex OAuth API namespace that omits standard authentication checks, constituting a CWE‑352 Cross‑Site Request Forgery vulnerability. In addition, the lack of an authorization guard allows any caller to write configuration via user‑controlled keys, a CWE‑862 Authorization Bypass. This oversight lets unauthenticated callers invoke write operations such as logout, API key creation, and configuration mutation. An attacker can disable a Plex integration, inject a malicious API key, or bind the instance to an attacker‑controlled Plex account. The API also accepts attacker‑supplied server URLs, later triggering outbound requests that include the configured Plex token in an HTTP header, enabling server‑side request forgery and accidental credential leakage.

All instances of morpheus65535 Bazarr released before version 1.5.7‑beta.14 are vulnerable. The flaw resides in the file bazarr/api/plex/oauth.py, impacting every prior release that did not contain the authentication guard.

With a base CVSS score of 10, the vulnerability is classified as critical. Even though EPSS data are unavailable, the lack of authentication and state validation means a remote attacker could exploit the flaw from any network they can reach the API, performing full configuration tampering and SSRF with the configured Plex token. The vulnerability is not yet listed in the CISA KEV catalog, but its high severity and the public nature of the exploitation path warrant immediate attention.