If you connect Music Assistant to a Jellyfin server, the account token it uses could be read by every client that has access to the music library. A fix by Marvin Schenkel was merged into the Music Assistant server on 23 October 2026 and shipped the same day in 2.11.0 beta 7. The issue was reported on Discord.
What was exposed
The aiojellyfin library that the Jellyfin provider uses adds api_key=<token> to audio and artwork URLs. Music Assistant stored those URLs as they were:
- as the track's provider link, which was a full stream URL that the web interface opens under "open provider link";
- as image paths for artwork.
Both are returned to API clients, so anyone with access to the library could pull the token out of a URL. That token belongs to the Jellyfin account configured in the provider, and the pull request notes that this is often an administrator account.
What changed
- The provider link now points to the track's details page in the Jellyfin web interface instead of a stream URL.
- Artwork paths are stored without the token. When an image is requested, Music Assistant adds the token on the server, and only for URLs of the configured Jellyfin server.
Library entries saved before the fix still contain the old token. The pull request does not migrate them. Instead, it relies on Jellyfin: when the provider signs in again with its existing device ID, Jellyfin invalidates the previous token, so the old copies stop working.
Which version has it
The fix is in Music Assistant 2.11.0 beta 7, released on 23 October 2026. The stable 2.10.8, released a few hours earlier that day, does not list it in its release notes. If you run the stable channel and share Music Assistant with other people, keep in mind that they can still see the token until the fix reaches a stable release.