Description
Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Plex Media Server
Default version status: unaffected
1.41.7.x to < 1.42.1affected
References
- https://www.plex.tv/media-server-downloads/ ↗
- https://forums.plex.tv/t/plex-media-server-security-update/928341 ↗
- https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerability-immediately/ ↗
- https://www.runzero.com/blog/plex/ ↗
- https://www.tenable.com/plugins/nessus/250294 ↗
- https://www.vulncheck.com/advisories/plex-media-server-unspecified ↗
- https://github.com/lufinkey/vulnerability-research/tree/main/CVE-2025-34158 ↗
- https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md ↗