Able to create Admin user with empty password #6407

New issue

Open

opened 2025-12-22 04:12:22 +01:00 by backuprepo · 1 comment

backuprepo commented

2025-12-22 04:12:22 +01:00

Owner

Originally created by @LePips on GitHub (Oct 31, 2024).

This issue respects the following points:

This is a bug, not a question or a configuration issue; Please visit our forum or chat rooms first to troubleshoot with volunteers, before creating a report. The links can be found here.
This issue is not already reported on GitHub (I've searched it).
I'm using an up to date version of Jellyfin Server stable, unstable or master; We generally do not support previous older versions. If possible, please update to the latest version before opening an issue.
I agree to follow Jellyfin's Code of Conduct.
This report addresses only a single issue; If you encounter multiple issues, kindly create separate reports for each one.

Description of the bug

The server has moved to forbidding admin users with empty passwords when changing user passwords, however you can create a user that isn't an admin with an empty password and then make them an admin.

Tested on 10.9 and 10.10.

Reproduction steps

1 - Create normal user with empty password
2 - Update user policy IsAdministrator to true, or Allow this user to manage the server in web
3 - Now user with empty password is admin

What is the current bug behavior?

An admin with empty password is allowed.

What is the expected correct behavior?

Probably an error, but I am honestly unsure of how to properly check this condition without looking at the password on server.

Jellyfin Server version

10.10.0+

Specify commit id

No response

Specify unstable release number

No response

Specify version number

No response

Specify the build version

10.10.0

Environment

N/A, is API issue.

Jellyfin logs

Get 200 🤷

FFmpeg logs

No response

Client / Browser logs

No response

Relevant screenshots or videos

No response

Additional information

No response

Originally created by @LePips on GitHub (Oct 31, 2024). ### This issue respects the following points: - [x] This is a **bug**, not a question or a configuration issue; Please visit our forum or chat rooms first to troubleshoot with volunteers, before creating a report. The links can be found [here](https://jellyfin.org/contact/). - [x] This issue is **not** already reported on [GitHub](https://github.com/jellyfin/jellyfin/issues?q=is%3Aopen+is%3Aissue) _(I've searched it)_. - [x] I'm using an up to date version of Jellyfin Server stable, unstable or master; We generally do not support previous older versions. If possible, please update to the latest version before opening an issue. - [x] I agree to follow Jellyfin's [Code of Conduct](https://jellyfin.org/docs/general/community-standards.html#code-of-conduct). - [x] This report addresses only a single issue; If you encounter multiple issues, kindly create separate reports for each one. ### Description of the bug The server has moved to forbidding admin users with empty passwords when changing user passwords, however you can create a user that isn't an admin with an empty password and _then_ make them an admin. Tested on 10.9 and 10.10. ### Reproduction steps 1 - Create normal user with empty password 2 - Update user policy `IsAdministrator` to true, or `Allow this user to manage the server` in web 3 - Now user with empty password is admin ### What is the current _bug_ behavior? An admin with empty password is allowed. ### What is the expected _correct_ behavior? Probably an error, but I am honestly unsure of how to properly check this condition without looking at the password on server. ### Jellyfin Server version 10.10.0+ ### Specify commit id _No response_ ### Specify unstable release number _No response_ ### Specify version number _No response_ ### Specify the build version 10.10.0 ### Environment N/A, is API issue. ### Jellyfin logs Get 200 :shrug: ### FFmpeg logs _No response_ ### Client / Browser logs _No response_ ### Relevant screenshots or videos _No response_ ### Additional information _No response_