PT-2026-1109 · Plex · Plex Media Server

Published 2026-01-02 · Updated 2026-02-27 · CVE-2025-69415

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plex Media Server versions prior to 1.42.2.10157

Description Plex Media Server (PMS) has an issue where access to the /myplex/account endpoint with a device token is not correctly linked to the device's account association status. This could allow unauthorized access.

Recommendations Update Plex Media Server to version 1.42.2.10157 or later.

Exploit

Fix

Weakness Enumeration

CWE-672

Related Identifiers

CVE-2025-69415

Affected Products

Plex Media Server

References · 6

• 🔥 https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-69415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69415 · Security Note
• https://twitter.com/CVEnew/status/2007168120277086671 · Twitter Post
• https://reddit.com/r/PleX/comments/1q4wmdj/plex_made_the_cisa_vulnerability_summary_for_the · Reddit Post
• https://t.me/cveNotify/153516 · Telegram Post