Fling to Android Player leaves flinging user logged in (auth flaw)

Plex Players Streaming Devices
1

Server Version#: 1.19.5.3112
Player Version#: 8.14.0.23432 (Plex for Android (TV))

I tested the plex app out on the new Google TV and logged in with a “new” user (new, as in a completely new plex.tv account, not a home account), that had a few of my libraries shared with it.

I then used my Android phone, logged in as the server admin user, to connect to the Plex app in Google TV (NOT using the chromecast endpoint). Playback worked, even on libraries that wasn’t shared with the new user. After I stolled playback, it actually left the Plex app on Google TV in a state where my server admin user was logged in, on the Google TV app which seems like a huge authentication flaw. Even more flawed, is that my admin user also has a PIN code, which wasn’t requested at all in the Google TV app at any point here.

I assume this affects all Android TV platforms, but have no other to test.

2

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.