Plex

Not accepted

• Sessions or tokens not automatically invalidated after logout, password change, email change, disabling 2FA, or revoking a linked provider.
• Tokens (e.g., X-Plex-Token ) appearing in URLs / GET requests over HTTPS.
• Access/auth tokens stored in browser localStorage absent a separately-demonstrated vulnerability that reads them.
• Long-lived or long-idle sessions remaining valid.
• TOTP codes being valid on multiple devices, or reusable within their time window.
• 2FA recovery/backup codes remaining valid across devices, after a password change, or “indefinitely.”
• Email verification not being required to enable 2FA
• No re-authentication prompt before sensitive actions
• Rate-limit / brute-force / OTP-resend “bypasses”
• Missing rate limiting as a standalone finding
• Missing HTTP security headers
• Clickjacking on pages with no sensitive, state-changing action.
• Open redirects and CORS “misconfigurations”
• env.js / JavaScript environment disclosure
• Files that are intentionally public
• Secrets or credentials found in repositories, URLs, or archives that Plex does not own
• Credentials from third-party breach or “combo” dumps
• Denial of Service (DoS/DDoS) and resource-exhaustion reports
• Findings requiring a pre-existing compromise or trust-boundary crossing
• PIN-protection “bypass.”
• Reports against CVEs already patched
• Self-XSS , content spoofing / text injection with no cross-user impact
• Output of automated scanners with no demonstrated impact
• Issues affecting only outdated or end-of-life browsers or operating systems.