Music Assistant stops sending the connected Jellyfin account’s access token to everyone who can read its music library. The token appeared inside track and artwork addresses returned to clients, potentially exposing an account with administrator privileges.
Marvin Schenkel replaces the track address with Jellyfin’s ordinary details page and adds artwork credentials only on the server, for the configured Jellyfin host. Existing library rows can still contain the old token; Jellyfin invalidates it when the provider signs in again using its existing device identity.