PT-2026-1109 · Plex · Plex Media Server

CVE-2025-69415 · Publicado 2026-01-02 · Atualizado 2026-02-27

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plex Media Server versions prior to 1.42.2.10157

Description Plex Media Server (PMS) has an issue where access to the /myplex/account endpoint with a device token is not correctly linked to the device's account association status. This could allow unauthorized access.

Recommendations Update Plex Media Server to version 1.42.2.10157 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-672

Identificadores relacionados

CVE-2025-69415

Produtos afetados

Plex Media Server

Referências · 6

• 🔥 https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-69415 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2007168120277086671 · Publicação no Twitter
• https://reddit.com/r/PleX/comments/1q4wmdj/plex_made_the_cisa_vulnerability_summary_for_the · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69415 · Nota de Segurança
• https://t.me/cveNotify/153516 · Publicação no Telegram