Strange Access without access

Plex Media Server Remote Access
1

Server Version#: 1.15.5.994
Player Version#:Latest (Android)

I tried to setup a friends android box with access to my server around 12 months ago. It wouldnt work right so we gave up. App seemed to not play anything, reported server went away or unavailable.
Anyway, cut a long story short, I removed him from my shared friends list and forgot about it.

Yesterday I decided to have another go for him, this time using Plex for Kodi. I setup everything and logged him in on the plex for kodi addon. Now remember I removed him from my shared friends list. Once Kodi loaded up, it showed my server in his servers list. I chose it and tested and it works fine. But he is NOT in my shared users list!!!
I tried logging into a browser with his credentials and it shows no servers. So why does the android box seem to give him access when he doesn’t have any?

I have since re-added him so I can control the access, but he was able to view all my sections, even photo’s.

I think maybe this was picking up a token from the previous login on the plex app that wouldnt work, but why would it still work and show my server when he wasn’t in my allowed list?

2

When you were logged in with your own plex credentials in the browser
and you put in the linking code in this browser
then you added his box to your account, instead of his.

3

I wasnt logged in with mine and didnt link it with mine. i used a completely different browser with his credentials. I was gobsmacked when my server appeared. I even went and double checked my shared users did not contain his email. Yet when I streamed from his android box, it showed his email in my plex activity. :frowning:

4

As mentioned, I logged in as him from IE on my laptop, clicked launch and no servers. Yet the android device shows 1 server, mine. :frowning:

5

Did you take his device home, into your own home network?

You might have disabled authentication for devices on your own network.
(Settings - Server - Network - (Show Advanced) - " List of IP addresses and networks that are allowed without auth"

6

You are right, silly me. I have a wildcard set 192.168.1.* on home lan. Thanks and sorry for the confusion. I was at home when I did it. Thats why the browser didnt log in, i went via plex.tv.