He claims there are known exploits. Though I also want to know if this is really true.
https://github.com/jellyfin/jellyfin/issues/5415
https://github.com/jellyfin/jellyfin/issues/5415