CVE-2024-49763
PlexRipper is a cross-platform media downloader for Plex. PlexRipper’s open CORS policy allows attackers to gain sensitive information from PlexRipper by getting the user to access the attacker’s domain. This allows an attacking website to access the /api/PlexAccount endpoint and steal the user’s Plex login. This vulnerability is fixed in 0.24.0.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.52%
- CWE
- CWE-942
- Published
- 2024-12-02
- Last modified
- 2026-03-13
Affected products
- PlexRipper PlexRipper
Weakness type
Related vulnerabilities
- CVE-2026-62895 — Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
- CVE-2026-12962 — A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote...
- CVE-2026-84452 — Windows ML CLI: CORS misconfig enables localhost RCE
- CVE-2026-53649 — Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
- CVE-2026-82291 — HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
- CVE-2026-82287 — Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials
- CVE-2026-53656 — FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data
- CVE-2026-63407 — Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses