Well I already have jellyfin running in a container, just have to figure out how to get mum's TV to work with it I guess
log in on a local IP and not the network name and it's working again. but I'll be moving to jellyfin from now
there are some admin endpoints that are authenticated using any local IP, but the method they use allows spoofing the IP so those endpoints become accessible essentially without authentication
there were some other issues to do with unauthenticated enumeration and playback of content i believe too