Selfhosted

I'm so tired of seeing this overblown reaction to ancient non-news.

Yes, there are some minor vulnerabilities in Jellyfin; but they really really aren't concerning.

Unauthenticated, a random person could potentially (with some prior knowledge of this specific issue, and some significant effort randomly generating media UUIDS to tryout) retrieve/playback some media unauthorized. THATS IT. That's the ONLY real concern. And it's one you could mitigate with a fail2ban filter if you were that worried about it.

The other 'issues' here, are the potential for your already authenticated users to attack each others settings. Who do you share your server with that you're concerned about them attacking each other???

Put this to bed and stop fussing over it. It's genuinely not worth your time or attention. Exposing Jellyfin to the net is fine.

Dev comment on the situation: (4 days ago) https://github.com/jellyfin/jellyfin/issues/5415#issuecomment-2825240290

I use a reverse proxy via NGINX Proxy Manager to expose to the web but allow easy access for my users. I pay $10 a year for a domain name to make access easier.

I use a VPS and a Wiregusrd tunnel together with geoblocking and fail2ban. I've written my setup down, maybe this will help you https://codeberg.org/skjalli/jellyfin-vps-setup

Oof, a lot of vitriol in this thread.

In the end, security is less about tooling and config, and more about understanding the risks and acting accordingly.

I expose jellyfin to the internet, but only to a specific public IP. That reduced my risk considerably.

I expose jellyfin to the internet, and some precautions I have taken that I don't see mentioned in these answers are: 1) run jellyfin as a rootless container, and 2) use read-only storage where ever possible. If you have other tools managing things like subtitles and metadata files before jellyfin there's no reason for jellyfin to have write access to the media it hosts. While this doesn't directly address the documented security flaws with jellyfin, you may as well treat it like a diseased plague rat if you're going to expose it. To me, that means worst case scenario is the thing is breached and the only thing for an attacker to do is exfiltrate things limited to jellyfin.

I have it as an unprivileged container behind a reverse proxy and HTTPS/HSTS. I know it's not perfect but I keep backups of important shit and monitor things regularly.

I agree that Jellyfin needs to improve its API security, though. Their excuse that "it would break clients on old APIs" is moot when C# comes with API versioning features out of the box.

You can share jellyfin over the net.

The security issues that tend to be quoted are less important than some people claim them to be.

For instance the unauthorized streaming bug, often quoted as one of the worst jellyfin security issues, in order to work the attacker need to know the exact id of the item they want to stream, which is virtually impossible unless they are or have been an authorized client at some point.

Just set it up with the typical bruteforce protections and you'll be fine.

You can share jellyfin on the net. I do.

The issues shared wide and large are mostly moot points, where the attacker needs to already have access to the jellyfin itself to have any surface.

Its FUD and I am convinced spread by Plex people in an effort to cover up their fuckup and enshittyfication.

Netbird/Tailscale

You also could use Wireguard as it is a p2p protocol by default.

If you have IPv6 access you could put in on a IPv6 address

When I did this I set up a VPN on my network and forced anyone that wanted to use it to get on my network.

AppleTV + Tailscale in and it’s been a flawless experience.

There are two routes. VPN and VPS.

VPN; setup wireguard and offer services to your wireguard network.

VPS; setup a VPS to act as a reverse proxy for your jellyfin instance.

Each have their own perks. Each have their own caveats.

I do. I run it behind a caddy service so it's secured with an SSL. The port is running on a high non standard one. I do keep checking access logs but haven't had a peep apart from the 1 person I shared it with

I don't do this, but I would set up oAuth like Authelia or something behind a reverse-proxy and authenticate Jellyfin clients through that.