CVE-2026-16224: MoviePilot Auth Bypass Vulnerability

CVE-2026-16224 Overview

CVE-2026-16224 is an improper authorization vulnerability [CWE-266] in jxxghp MoviePilot versions up to 2.13.5. The flaw resides in an unknown function within the Application API component reachable through the /jxxghp/MoviePilot path. Authenticated remote attackers can manipulate the affected element to bypass authorization checks on sensitive system endpoints. The maintainers have published commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900 to remediate the issue. The patch restricts access to sensitive endpoints in app/api/endpoints/login.py and app/api/endpoints/mfa.py by introducing request and response scoping.

Critical Impact
An authenticated remote attacker can access sensitive system API endpoints in MoviePilot, exposing confidentiality of media automation configuration and authentication-adjacent functionality.

Affected Products

jxxghp MoviePilot versions up to and including 2.13.5
MoviePilot Application API component
Deployments exposing MoviePilot endpoints to untrusted networks

Discovery Timeline

2026-07-19 - CVE-2026-16224 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-16224

Vulnerability Analysis

MoviePilot is a Python-based media automation platform built on FastAPI. The vulnerability stems from missing authorization enforcement on sensitive system endpoints exposed by the Application API. A user with low-privilege credentials can invoke functionality intended for higher-privileged roles. The maintainer patch modifies the login and multi-factor authentication endpoints, introducing FastAPI Request and Response objects to scope endpoint behavior and restrict sensitive operations. This indicates the original endpoints did not adequately validate the calling principal or session context before executing privileged logic.

Root Cause

The root cause maps to CWE-266 (Incorrect Privilege Assignment). Endpoint handlers in login.py and mfa.py did not enforce sufficient authorization boundaries between authenticated users and administrative operations. Because FastAPI dependencies were not scoped to the request context, sensitive routes could be reached by any authenticated caller.

Attack Vector

Exploitation requires network access to the MoviePilot instance and a valid low-privilege account. The attacker sends crafted HTTP requests to the affected endpoints under /jxxghp/MoviePilot, invoking functionality that should be restricted. No user interaction is required beyond issuing the API call.

python

# Patch excerpt: app/api/endpoints/login.py
 from datetime import timedelta
 from typing import Any, List, Annotated
 
-from fastapi import APIRouter, Depends, Form, HTTPException
+from fastapi import APIRouter, Depends, Form, HTTPException, Request, Response
 from fastapi.security import OAuth2PasswordRequestForm
 
 from app import schemas

# Patch excerpt: app/api/endpoints/mfa.py
 from typing import Any, Annotated, Optional
 
 from app.helper.sites import SitesHelper
-from fastapi import APIRouter, Depends, HTTPException, Body
+from fastapi import APIRouter, Depends, HTTPException, Body, Request, Response
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app import schemas

Source: GitHub Commit dc2b691. The patch adds Request and Response imports so handlers can access and enforce request-scoped context on sensitive login and MFA operations.

Detection Methods for CVE-2026-16224

Indicators of Compromise

Unexpected HTTP requests to /jxxghp/MoviePilot API endpoints originating from low-privileged user sessions.
Access log entries showing repeated calls to login or MFA endpoints outside of normal authentication flows.
Application logs indicating authorization decisions being bypassed or missing role checks on sensitive routes.

Detection Strategies

Compare deployed MoviePilot version against 2.13.5 and confirm whether commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900 is applied.
Instrument reverse proxy or WAF rules to flag anonymous or low-privilege access attempts to sensitive API paths.
Correlate FastAPI access logs with authentication events to identify sessions issuing privileged calls without corresponding admin authentication.

Monitoring Recommendations

Enable verbose application logging for the login and mfa endpoint modules to capture caller identity and outcome.
Forward MoviePilot container and web logs to a centralized log platform for baseline analysis and anomaly detection.
Alert on authenticated sessions accessing endpoints that fall outside their historical usage pattern.

How to Mitigate CVE-2026-16224

Immediate Actions Required

Upgrade MoviePilot beyond version 2.13.5 to a release that includes commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900.
Restrict network exposure of MoviePilot to trusted management networks or place it behind an authenticated reverse proxy.
Rotate any credentials or session tokens that may have been used against unpatched instances.

Patch Information

The maintainer fix is delivered in commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900, which restricts sensitive system endpoints by extending the FastAPI signatures with Request and Response parameters and applying access controls. Details are tracked in GitHub Issue #5916 and referenced in VulDB CVE-2026-16224.

Workarounds

Block external access to the /jxxghp/MoviePilot API path at the reverse proxy or firewall until the patch is applied.
Restrict MoviePilot user account creation and disable low-privilege accounts that are not strictly required.
Enforce network-level authentication (mTLS or VPN) in front of MoviePilot to reduce the pool of potential authenticated attackers.

bash

# Example nginx snippet to restrict MoviePilot API to a management CIDR
location /jxxghp/MoviePilot {
    allow 10.10.0.0/24;
    deny all;
    proxy_pass http://moviepilot_backend;
}