Have you even read the issues and understood them?
Yes, those should be fixed, but unless you are worried about someone hijacking a video stream when you use a generic media path, there is not that much to worry about.
All (raw) image endpoints in ImageByNameController, ImageController & RemoteImageController are unauthenticated
This allows probing on whether a specific image exists on the server by guessing item id’s (which can be done without too much trouble, as item ids are based on filepath and filename information) and then checking on what content (movies, series etc) exist on a given server, without having an account.
https://github.com/jellyfin/jellyfin/issues/5415
I’ll be sticking to Plex until it is reasonably safe to expose JF.
Have you even read the issues and understood them?
Yes, those should be fixed, but unless you are worried about someone hijacking a video stream when you use a generic media path, there is not that much to worry about.
All (raw) image endpoints in ImageByNameController, ImageController & RemoteImageController are unauthenticated
You shouldn’t be exposing any self-hosted service to the public Internet, unless you’re willing to also monitor for potential breaches.
You should really not be exposing jellyfin OR plex to the open Internet. It’s just asking for trouble.
that’s literally the feature of Plex…