A home media server rarely gets a security review, yet CVE-2026-96652 targets exactly the setup many households run: Plex Media Server reachable from the internet, with a handful of shared accounts. The flaw lets an attacker supply a URL in a timeline request and have the server POST to it. For an operator the practical question is which exposures the fix removes.

Vulnerability overview

The CNA records Plex Media Server before 1.43.3.10861 allowing SSRF through /player/timeline, where any X-Plex-Token value lets an attacker place a full URL in the protocol parameter and force a POST to a chosen destination. CVSS v3.1 4.3, CVSS v4.0 5.3, CWE-918. CISA's SSVC entry records Exploitation as none and Automatable as no.

Mechanism and exploitation conditions

The vulnerable endpoint handles playback progress. Instead of validating that the protocol value is a scheme, the server uses it to build an outbound request. The record's wording about any token suggests the check is shallow, which matters for anyone who has opened the server to the internet for remote streaming. No user interaction is required, so nobody has to approve the request.

Impact

Confidentiality impact is low and there is no integrity or availability impact in the v3.1 vector. At home the interesting target list is small but not empty: router administration pages, network storage, smart-home hubs and anything else that trusts traffic from the media host. An attacker who can make the server send requests learns which of those respond.

Affected products and scope

Every Plex Media Server build below 1.43.3.10861 is affected. Households that publish the server through a router port forward take the widest exposure, while those that stream through the vendor relay keep a narrower path.

Exposure context

A ZoomEye query for app="Plex Media Server" returned 507,974 matching assets during preparation, illustrating how common public Plex endpoints are. The figure describes product deployment and says nothing about which of those servers run a vulnerable version; the CVE-specific filter for CVE-2026-96652 returned zero matches.

Remediation and mitigations

Update the server to 1.43.3.10861 or later and restart the Plex service. Turn off manual port forwarding unless it is genuinely needed, and use the relay or a VPN for remote viewing instead. Review shared users and remove accounts that no longer need access, then check that the media host cannot reach router or storage management interfaces on the local network.

References

  1. 1.

    CVE-2026-96652 record, https://www.cve.org/CVERecord?id=CVE-2026-96652

  2. 2.

    Plex Media Server release notes, https://forums.plex.tv/t/plex-media-server/30447/711

  3. 3.

    CISA CSAF advisory, https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json

  4. 4.

    CNA record, https://cveawg.mitre.org/api/cve/CVE-2026-96652