Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the "api_ns_plex" namespace in "bazarr/api/plex/oauth.py" omits "@authenticate" on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke "POST /api/plex/oauth/logout" to clear credentials and disable the integration, or "POST /api/plex/apikey" to persist an attacker-selected key, without a PIN, account or state precondition. "POST /api/plex/oauth/pin" and "GET /api/plex/oauth/pin/<pin_id>/check" additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. "PlexPinCheck" skips state validation when "state_param" is absent and merely logs a mismatch without stopping execution. "POST /api/plex/select-server", "POST /api/plex/oauth/servers", "POST /api/plex/webhook/create", "POST /api/plex/webhook/delete" and "POST /api/plex/encrypt-apikey" expose further "write_config()" operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in "X-Plex-Token", enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.