CVE-2025-34158 HIGH

CVE-2025-34158

Vendor Plex
Product Media Server
Weakness CWE-669
Published August 21, 2025
Last update January 2, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).

Key dates

02Disclosure timeline

August 21, 2025 CVE published
January 2, 2026 Record updated