Description
Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected products
- Plex / Media Server1.41.7.x – 1.42.1
References
- MISChttps://www.plex.tv/media-server-downloads/
- MISChttps://forums.plex.tv/t/plex-media-server-security-update/928341
- MISChttps://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerability-immediately/
- MISChttps://www.runzero.com/blog/plex/
- MISChttps://www.tenable.com/plugins/nessus/250294
- VENDOR_ADVISORYhttps://www.vulncheck.com/advisories/plex-media-server-unspecified
- MISChttps://github.com/lufinkey/vulnerability-research/tree/main/CVE-2025-34158
- MISChttps://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md
Updated 45m ago · 8 sources