I expose jellyfin to the internet, and some precautions I have taken that I don't see mentioned in these answers are: 1) run jellyfin as a rootless container, and 2) use read-only storage where ever possible. If you have other tools managing things like subtitles and metadata files before jellyfin there's no reason for jellyfin to have read access to the media it hosts. While this doesn't directly address the documented security flaws with jellyfin, you may as well treat it like a diseased plague rat if you're going to expose it. To me, that means worst case scenario is the thing is breached and the only thing for an attacker to do is exfiltrate things limited to jellyfin.
this post was submitted on 25 Apr 2025
44 points (95.8% liked)
Selfhosted
46293 readers
662 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
Netbird/Tailscale
You also could use Wireguard as it is a p2p protocol by default.
If you have IPv6 access you could put in on a IPv6 address
You can share jellyfin on the net. I do.
The issues shared wide and large are mostly moot points, where the attacker needs to already have access to the jellyfin itself to have any surface.
Its FUD and I am convinced spread by Plex people in an effort to cover up their fuckup and enshittyfication.
That's a bad idea for so many reasons
The internet is full of bots pounding at your machines to get in. It is only a matter of time until the breach Jellyfin. At the very least you want a reverse proxy with proper security.
I don't see why you would put something like Jellyfin in the internet. Use a VPN solution.
I love Jellyfin and use it. I also think the security issues are very serious and it's irresponsible to not fix them. At the very least they can make a new API and give users the option to enable or disable the insecure one until clients get updated. But they don't.
I've decided to remove public access to my Jellyfin server until it's resolved, though it's still accessible behind my VPN.
I also think Plex probably has open vulns and it's also a more known target. The nail that sticks out furthest gets nailed down.
load more comments
(4 replies)
You can share jellyfin over the net.
The security issues that tend to be quoted are less important than some people claim them to be.
For instance the unauthorized streaming bug, often quoted as one of the worst jellyfin security issues, in order to work the attacker need to know the exact id of the item they want to stream, which is virtually impossible unless they are or have been an authorized client at some point.
Just set it up with the typical bruteforce protections and you'll be fine.
Fine is a relative term
You probably are fine but the company who is getting attacked by your compromised machine isn't
It's not impossible, Far from it. The ids are not random uuids but hashes derived from the path. Since most people have a similar setup to organize their media, this gets trivial very fast
If you're worried about it, make sure to not use a default path. Then legit clients are fine but these theoretical attackers get stymied.
This. Just setup fail2ban or similar in front of Jellyfin and you'll be fine.
I share Jellyfin.
Behind a Reverse Proxy with 2FA that breaks client support.
So only web browser :)
I do. I run it behind a caddy service so it's secured with an SSL. The port is running on a high non standard one. I do keep checking access logs but haven't had a peep apart from the 1 person I shared it with
That port changing stuff is way outdated and hasn't been effective for a long time.
When I did this I set up a VPN on my network and forced anyone that wanted to use it to get on my network.
load more comments
(7 replies)
There are two routes. VPN and VPS.
VPN; setup wireguard and offer services to your wireguard network.
VPS; setup a VPS to act as a reverse proxy for your jellyfin instance.
Each have their own perks. Each have their own caveats.
The VPS would still involve exposing it
I don't do this, but I would set up oAuth like Authelia or something behind a reverse-proxy and authenticate Jellyfin clients through that.
that's what I'd like personally, but I don't think the clients would play nice with that
They are out of luck if using the Android TV client but web browser should be fine
I've been making people use VPN, but that's been a huge barrier to entry. I'm in the process of switching to IP allow list in traefik.
You could probably set up a cloudflare tunnel. I forget what they call it. I think technically sending video through it is against their TOS but if just a few friends and family are using it I doubt you will hit their naughty list.
load more comments
(2 replies)
view more: next ›