CVE-2026-96652: how Plex Media Server turns one request field into an outbound POST

Plex Media Server handles playback progress for clients that report their position during a stream. In releases before 1.43.3.10861 the endpoint used for those timeline updates accepted a URL in its protocol parameter and passed that URL to a server-side request. The CNA record for CVE-2026-96652 describes the result in one sentence: an attacker who supplies any X-Plex-Token value can force the server to POST to a destination of their choosing. The flaw sits in the server's request handling, not in a client application, so the affected component is the media server itself.

Vulnerability overview

CVE-2026-96652 is a server-side request forgery (SSRF) issue rated CWE-918. The CNA assigns CVSS v3.1 base score 4.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N , and a CVSS v4.0 score of 5.3. The same record lists affected versions as below 1.43.3.10861 and marks that version unaffected.…