wizard seems insecure

[noname]

Hello,
Just setup jellyfin.  if I go to: 

Code:

http://[IP ADDRESS]:8096/web/index.html#!/wizardstart.html

I can just overwrite the admin user and password with whatever .... is this normal?  Maybe I need to read more.... LOL

---

[niels]

And have you tried actually doing that too? Because I'm quite sure it won't so anything.

[Venson]

this works because you are still "logged in" as an admin user though the sites cookies.
Try it in an private window and you will get an error as soon as you try to actually submit something.