Why any X-Plex-Token value matters in the Plex timeline SSRF

Most SSRF advisories stop at the request the attacker can make. The CNA record for CVE-2026-96652 adds a detail that changes how defenders should read the flaw: the server accepts any X-Plex-Token value on the vulnerable path. That wording moves the barrier away from token validity and towards simple reachability of one endpoint.

Vulnerability overview

The record describes Plex Media Server before 1.43.3.10861 allowing SSRF through /player/timeline , where an attacker with any X-Plex-Token value can put a full URL into the protocol parameter and force a POST to a chosen destination. CVSS v3.1 is 4.3 with AC:L , PR:L and UI:N , the weakness is CWE-918, and CVSS v4.0 is 5.3. CISA's SSVC assessment records Exploitation as none, Automatable as no and Technical Impact as partial.

Mechanism and exploitation conditions

Plex clients authenticate to the server with a token passed in a request header.…