Threats affecting pkg:github/morpheus65535/bazarr

Bazarr versions prior to 1.5.7-beta.14 contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities in the Plex API namespace due to missing authentication and incomplete OAuth state validation. These flaws allow anonymous attackers to manipulate API keys, clear credentials, bind attacker-controlled Plex accounts, and perform configuration changes without authorization. The vulnerabilities enable persistent configuration tampering, denial of service of the Plex integration, and potential server-side request forgery with credential exposure. Version 1.5.7-beta.14 addresses the anonymous API mutation by adding authentication, although some OAuth state validation issues remain.