Minecraft mod PixelReel leaks Plex and Jellyfin API keys — developer admits it was 'vibe coded'

A Minecraft mod called PixelReel, released just seven days ago, has drawn attention for its ability to stream media onto an in-game television using Tunarr, Jellyfin, Emby, and Plex. However, Reddit user ObiWanHiGround has uncovered a critical security flaw: the mod exposes your media server URLs and API keys to other players on the same multiplayer server.

The vulnerability affects version pixelreel-1.0.0.jar and the 26.3 snapshots uploaded to CurseForge. The mod requires users to process streams locally through VLC, and it extracts authentication details into Minecraft, where they become accessible to other players. If attackers capture the leaked keys, they can view, download, or delete entire media libraries.

The developer of PixelReel admitted that the project was "vibe coded" — a term for building software without a formal security review. They described themselves as a hobbyist who does not get paid for the work, calling the shortcut excusable but acknowledging that a fix is needed before end users install it. As a workaround, users are advised to create a read-only account and use its API key with PixelReel instead of their main credentials. For those who have already installed the mod, it is recommended to revoke any compromised keys and change passwords immediately.