Leaving this for people to realize that there's a literal chapter's worth of book of security issues that haven't been fixed and seems to keep getting the can kicked down the road... for over 4 years now.

https://github.com/jellyfin/jellyfin/issues/5415

I love Jellyfin... people need to implement it sensibly knowing the potential risks.

Edit: Ah yes! I MUST be a shill for saying "Implement it sensibly".

Here, let me "de-shill" myself.

You have several options to make Jellyfin serviceable to users outside of your literal LAN network.

setup a VPN. Pray you don't have a user on a device that doesn't have a VPN app that you can work with.
setup whitelisting on your server. Pray that IP addresses don't change.
setup fail2ban or crowdsec. Pray that you users don't piss off either by doing user things and getting locked out.

If anything above fails... you're likely on the hook for support. Hope you plan for that!

Obfuscate your paths (change /movies/title (year)/title.ext to something like /9ZHBrvNH4dKQDYFa2parH32qqSFpjsWTataVkjy4NqPxpVktT55PkEee5YSVRvUQ/movies/title (year)/title.ext). MD5 is now much harder to generate/guess... pray that there isn't some other vulnerability. Gotta go back and reconfigure and organize your shit. Oh and make sure that your docker mounts aren't crushing the path!

Am I still a Plex shill? BTW I run Jellyfin AND Plex. Literally side by side. Different uses for different cases because Jellyfin just can't compete with Plex for sharing with dumb-ass relatives.