Jellyfin 12.0 Security Fixes and Legacy Login Removal

Post Views: 15

Jellyfin 12.0 introduces critical security updates alongside the deprecation of legacy authentication mechanisms, enhancing server security and user experience.

Security Updates and Legacy Authentication Deprecation

Jellyfin 12.0 addresses multiple vulnerabilities that could allow unauthorized access to restricted file systems. These patches prevent malicious actors from exploiting misconfigured servers to retrieve files outside designated media directories. Legacy authentication endpoints such as /emby/ and /mediabrowser/ are no longer supported, with the deprecated sign-in method disabled by default across all installations.

Configuration Improvements and Plugin Management

Additional improvements focus on initial configuration processes, plugin management, content filtering, and web interface integrity. A key enhancement resolves an issue where unauthenticated users could trigger the setup wizard multiple times on improperly configured installations. Plugin installation security has been strengthened by rejecting packages with suspicious naming conventions.

Web Client and Parental Control Enhancements

The web client receives patches for cross-site scripting vulnerabilities that could enable session hijacking. Parental control policies now apply to previously unsecured areas of the platform, ensuring stricter content filtering and user protection.

API Endpoint Removal and Property Deprecation

The API endpoint POST /Users/{userId}/EasyPassword has been removed, joining four other routes that were already non-functional. The UserDto.HasPassword property has been deprecated due to its diminished utility, streamlining server operations and reducing potential security risks.

Username Handling and Case Sensitivity

Version 12.0 enforces case-insensitive username handling, preventing the creation of duplicate accounts that differ only in capitalization. Servers containing such conflicts will fail database migration attempts, necessitating manual verification of user lists prior to upgrading.

TLS Support and Upgrade Preparation

While the project initially planned to eliminate built-in TLS support in this release, the change has been deferred to a future update. Current installations using Jellyfin’s internal TLS remain operational, though the recommendation to deploy behind a reverse proxy persists. Upgrade preparation requires updating third-party plugins to compatible versions, as official plugins have already been adjusted.

Database and Migration Requirements

Database schema modifications occur during the first boot, making pre-upgrade backups essential for rollback capabilities. Post-upgrade, a comprehensive library scan is mandatory, significantly extending initial scan durations. Administrators can initiate the migration manually using the –mode MigrateSystem flag, which performs the upgrade and exits without launching the full application.

Upgrade Path and Compatibility

The upgrade path mandates starting from version 10.10.7 or any 10.11.x release, with older versions requiring an intermediate step. Disabled plugins will retain their status after restarts, a behavior change from previous versions. The server now targets .NET 10, requiring plugin authors to release updated builds for compatibility.

Conclusion

Jellyfin 12.0 prioritizes security, usability, and compatibility, ensuring a robust platform for media management. Key updates include enhanced authentication, improved plugin security, and streamlined configuration processes. Administrators are advised to follow upgrade guidelines and back up databases before proceeding.