New Minecraft Mod Broadcasts Your Plex Keys to the Whole Server

PixelReel lets you stream Jellyfin, Plex, or Emby to in-game TVs. It also leaks your server URLs and API keys to every other player in the world. The hobbyist dev admits they skipped security review entirely. Rotate your keys if you used it.

PixelReel sounded like a neat idea. Drop a TV in your Minecraft base, hook it up to your self-hosted Jellyfin, Plex, or Emby server, and watch stuff without alt-tabbing. The mod hit CurseForge roughly seven days before the flaw blew up.

The problem is that it broadcasts your full server URL and API key to anyone else on the same multiplayer server. The data is apparently extracted during local VLC stream processing and then sent in plaintext. If you used your main account key instead of a restricted one, anyone with the mod can now access, download, or wipe your media library.

What you should do right now

• Remove PixelReel from any multiplayer clients immediately
• Rotate every exposed API key and consider adding IP restrictions
• Use a read-only Jellyfin or Plex user for any future in-game streaming experiments
• Wait for an actual patched release before reinstalling

The affected versions are pixelreel-1.0.0.jar and the 26.3 snapshots still up on CurseForge. There is no fixed build available as of August 22. The mod author is a hobbyist, which explains the shortcut but does not excuse exposing other people’s libraries.

If you do use it and attackers capture the leaked keys, they can use them to view, download, or delete your media libraries.

This is not some obscure edge case. The mod gained traction quickly because the concept is genuinely cool. That popularity is exactly why the leak matters. One person on a public server with the mod active can hoover up credentials from everyone else running it.

Minecraft’s mod ecosystem runs on trust. When that trust is violated this casually, the correct response is to call it out plainly instead of soft-pedaling with “oopsie.” If you run a media server and you installed PixelReel, treat this as a full credential compromise.