CVE-2025-69414

HIGH8.5Auth bypass

JSON export Create alert

Description

Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Affected products

Plex / Media Server0 – 1.42.2.10156
Plex / Media Server1.42.2.10156

References

MISChttps://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md

Updated 44m ago · 8 sources