Jellyfin accessible without authentication #7039

New issue

Closed

opened 2025-12-22 05:09:25 +01:00 by backuprepo · 2 comments

backuprepo commented

2025-12-22 05:09:25 +01:00

Owner

Originally created by @mrwrenchy on GitHub (May 26, 2025).

Description of the bug

I have a jellyfin server running on my local network, and it is for some reason visible on windows file manager, but that only was not the problem
there seems to be some security issue? or something maybe is wrong on my side and I need to fix something, but I can just click on the jellyfin webserver and its accessible without any authentication.

Reproduction steps

I do not know how this is possible, I had also recently formatted this windows PC, so it should not have authenticated in any way to the server.

What is the current bug behavior?

The server can be accessed and files can be transferred without any authentication.

What is the expected correct behavior?

It should either ask me for authentication, or it shouldn't be visible at all.

Jellyfin Server version

10.10.0+

Specify commit id

No response

Specify unstable release number

No response

Specify version number

No response

Specify the build version

10.10.7

Environment

- OS: debian 12
- Linux Kernel: 6.1.0-29-amd64
- Virtualization: none
- Clients: findroid, jellyfin mpv shim, jellyfin android, jelyfin web
- Browser: chrome
- FFmpeg Version: 7.1.1-Jellyfin
- Playback Method: 
- Hardware Acceleration:
- GPU Model:
- Plugins: AudioDB, Chapter Segments Provider, DLNA, Fanart, IMVDb, LrcLib, Merge Versions, MusicBrainz, OMDb, Open Subtitles, Playback Reporting, Reports, Studio Images, Subtitle Extract, TMDb, TMDb Box Sets, TheTVDB
- Reverse Proxy: none
- Base URL: 192.168.1.100
- Networking: HOST
- Storage: local

Jellyfin logs

I checked on the jellyfin logs, there are no entries when I access the filesystem through windows.

FFmpeg logs

Client / Browser logs

No response

Relevant screenshots or videos

Additional information

No response

Originally created by @mrwrenchy on GitHub (May 26, 2025). ### Description of the bug I have a jellyfin server running on my local network, and it is for some reason visible on windows file manager, but that only was not the problem there seems to be some security issue? or something maybe is wrong on my side and I need to fix something, but I can just click on the jellyfin webserver and its accessible without any authentication. ### Reproduction steps I do not know how this is possible, I had also recently formatted this windows PC, so it should not have authenticated in any way to the server. ### What is the current _bug_ behavior? The server can be accessed and files can be transferred without any authentication. ### What is the expected _correct_ behavior? It should either ask me for authentication, or it shouldn't be visible at all. ### Jellyfin Server version 10.10.0+ ### Specify commit id _No response_ ### Specify unstable release number _No response_ ### Specify version number _No response_ ### Specify the build version 10.10.7 ### Environment ```markdown - OS: debian 12 - Linux Kernel: 6.1.0-29-amd64 - Virtualization: none - Clients: findroid, jellyfin mpv shim, jellyfin android, jelyfin web - Browser: chrome - FFmpeg Version: 7.1.1-Jellyfin - Playback Method: - Hardware Acceleration: - GPU Model: - Plugins: AudioDB, Chapter Segments Provider, DLNA, Fanart, IMVDb, LrcLib, Merge Versions, MusicBrainz, OMDb, Open Subtitles, Playback Reporting, Reports, Studio Images, Subtitle Extract, TMDb, TMDb Box Sets, TheTVDB - Reverse Proxy: none - Base URL: 192.168.1.100 - Networking: HOST - Storage: local ``` ### Jellyfin logs ```shell I checked on the jellyfin logs, there are no entries when I access the filesystem through windows. ``` ### FFmpeg logs ```shell ``` ### Client / Browser logs _No response_ ### Relevant screenshots or videos ![Image](https://github.com/user-attachments/assets/aaa4c216-628f-4dff-b652-74ae89d166bf) ### Additional information _No response_