Plex vulnerabilities
Published CVEs affecting Plex products: 5 record(s), with severity, exploitation and fixes.
CVE-2025-69417
Medium · 4.3
CWE-863 Jan 2, 2026
Incorrect Authorization in Plex Media Server
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint.
CVE-2025-69416
Medium · 4.3
CWE-863 Jan 2, 2026
Incorrect Authorization in Plex Media Server
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml.
CVE-2025-69415
High · 7.1
CWE-672 Jan 2, 2026
In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with…
In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account.
CVE-2025-69414
High · 7.1
CWE-863 Jan 2, 2026
Incorrect Authorization in Plex Media Server
Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token.
CVE-2020-5741
High · 7.2
KEV High · 68 Public exploit CWE-502 May 8, 2020
Plex Media Server Remote Code Execution Vulnerability
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.