CVE-2026-96652

Plex Media Server SSRF

medium · 4.3

Known exploited

Fix listed

Plex Media Server

Published Sep 23, 2026, 16:06 UTC

Description

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

Reported fixed versions

1.43.3.10861

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.