CVE-2026-96652 in Media Server
Summary
by MITRE • 09/23/2026
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified as CVE-2024-3681 represents a critical Server-Side Request Forgery (SSRF) flaw within Plex Media Server versions prior to 1.43.3.10861. This security defect resides in the /player/timeline endpoint, which is designed to manage playback state and synchronization across client devices. The core technical failure lies in the insufficient validation of input parameters passed via HTTP requests. Specifically, an attacker can manipulate the protocol parameter by injecting a fully qualified Uniform Resource Locator (URL) rather than expecting standard protocol identifiers or relative paths. This lack of rigorous sanitization allows the server to interpret arbitrary external addresses as valid targets for internal processing logic.
The operational mechanism of this exploit relies on the authentication token provided in the X-Plex-Token header. Because the vulnerability can be triggered using any valid, albeit potentially low-privilege, X-Plex-Token value, it does not require administrative access or high-level credentials to execute. Once an attacker constructs a malicious request containing their controlled URL within the protocol parameter, the Plex server processes this input and initiates an HTTP POST request directed at the specified destination. This behavior effectively turns the vulnerable media server into a proxy for outbound network connections, allowing the attacker to leverage the server's internal network position and internet connectivity to reach resources that would otherwise be inaccessible from external networks.
The impact of this SSRF vulnerability is significant due to its potential for lateral movement within private networks. Attackers can use this vector to scan internal services, exploit other vulnerabilities on backend systems such as databases or administrative interfaces, or exfiltrate sensitive data by directing the server's POST requests to attacker-controlled servers that log incoming payloads. Furthermore, if the Plex Media Server is deployed in a cloud environment with access to metadata endpoints, attackers might attempt to retrieve instance credentials and configuration details from internal APIs like those found on AWS EC2 or Azure managed identities. This capability undermines the network segmentation strategy intended to protect backend infrastructure from external threats.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which covers flaws where an application retrieves data from a user-supplied URL without proper validation of the destination's legitimacy and safety. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1571 Non-Standard Port or T1090 Proxy, as it involves establishing communication channels through trusted but vulnerable services to bypass perimeter defenses. The use of standard authentication tokens also relates to CWE-287 Improper Authentication, although the primary issue is input validation rather than credential theft per se.
Mitigation strategies must prioritize immediate software updates and network segmentation. Users running Plex Media Server should upgrade immediately to version 1.43.3.10861 or later, where this input validation flaw has been addressed by developers implementing stricter type checking and URL parsing logic for the protocol parameter. For environments where patching is not instantly feasible, deploying a Web Application Firewall (WAF) with rules capable of detecting SSRF patterns in HTTP headers and parameters can provide temporary protection. Additionally, restricting outbound traffic from the Plex Media Server host to only necessary destinations via firewall rules limits the blast radius should an exploitation attempt succeed. Regular security audits focusing on input validation across all API endpoints are recommended to prevent similar vulnerabilities arising from inconsistent handling of user-supplied data.