Plex Media Server SSRF in /player/timeline fixed in 1.43.3.10861

Plex Media Server before 1.43.3.10861 is affected by CVE-2026-96652, an SSRF flaw where the protocol parameter in /player/timeline accepts a full URL, causing the server to send an outbound POST to an attacker-chosen host. CVSS is 4.3 (v3.1) and 5.3 (v4.0), CWE-918; upgrading to 1.43.3.10861 fixes it.

• CVE-2026-96652: SSRF via /player/timeline, CVSS 4.3 (v3.1) and 5.3 (v4.0)
• Exploitation needs two requests: one to timeline, one outbound POST
• Any X-Plex-Token value is enough to trigger the request
• ZoomEye counts 507,974 internet-facing Plex Media Server hosts