# CVE-2026-96652

> **Plex Media Server** vulnerability · **listed in CISA Known Exploited Vulnerabilities catalog** · severity: **MEDIUM** (CVSS 4.3).

## Description

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

## Key facts

- **CVE ID:** CVE-2026-96652
- **Vendor:** Plex
- **Product:** Media Server
- **Published:** 2026-09-23
- **CVSS severity:** MEDIUM
- **CVSS base score:** 4.3
- **CISA remediation due date:** 2026-11-03
- **CWE codes:** CWE-918

## Affected products

- `plex:media_server`

## Primary sources

- NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-96652
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

## Citation

> MORVS. CVE-2026-96652. Retrieved 2026-10-27 from https://api.morvs.ai/cve/CVE-2026-96652. Derived from NIST NVD + CISA KEV. Licensed CC0.

---

*[Dataset catalog](https://api.morvs.ai/datasets/) · [MORVS](https://morvs.ai/) · CC0 1.0*