russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.5 KiB

Raw Blame History

Jellyfin — CWE-312 Disclosure Brief (jellyfin-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Three CWE-312 (cleartext storage of sensitive information) defects in Jellyfin. Access tokens, Schedules Direct authentication tokens, and QuickConnect secrets are logged verbatim in application logs.

The Defects

jellyfin-0002-a (PATCHED — HIGH): Emby.Server.Implementations/Session/SessionManager.cs:1717

_logger.LogInformation("Logging out access token {0}", device.AccessToken);

Logs the full access token on logout. Access tokens grant authenticated API access.

jellyfin-0002-b (PATCHED — MEDIUM): src/Jellyfin.LiveTv/Listings/SchedulesDirect.cs:645

_logger.LogInformation("Authenticated with Schedules Direct token: {Token}", root.Token);

Logs the Schedules Direct API authentication token.

jellyfin-0002-c (PATCHED — LOW): Emby.Server.Implementations/QuickConnect/QuickConnectManager.cs:219

_logger.LogDebug("Removing expired secret {Secret}", secret);
_logger.LogWarning("Secret {Secret} already expired", secret);

Logs QuickConnect secrets during expiration cleanup.

Impact

Jellyfin is a widely deployed media server. These logs flow to systemd journal, log files, and any connected log aggregation service. Access tokens in logs enable session hijacking. Schedules Direct tokens enable unauthorized API access to paid listing services.

The Fix

Replace token/secret logging with safe identifiers:

// Before
_logger.LogInformation("Logging out access token {0}", device.AccessToken);
// After
_logger.LogInformation("Logging out access token for device {DeviceId}", device.DeviceId);

// Before
_logger.LogInformation("Authenticated with Schedules Direct token: {Token}", root.Token);
// After
_logger.LogInformation("Authenticated with Schedules Direct successfully");

Patch

Fix available: defects/jellyfin-0002/patch/jellyfin-0002.patch

Three-file patch across SessionManager.cs, SchedulesDirect.cs, and QuickConnectManager.cs. Removes all cleartext credential logging.

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (jellyfin/jellyfin).
Assess severity — access tokens logged on every session logout.
Coordinate a disclosure date — we are targeting 90 days from first contact.
We will credit the Jellyfin team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Blame History