CVE-2025-69417CWE-863broken-access-control

CVE-2025-69417

Medium · published January 2, 2026

CVSS v3.1

5.0

EPSS

Percentile

21.3

In the wild

Unconfirmed

What it is

In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint.

The record

Technical detail

CVSS v3.1: 5.0 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00298 · 21.3th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2026-01-02T22:16Z

Affected products (1)

Product	Versions	Fixed in
plex/media_server	≤ 1.43.0.10389	—

References (1)

https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md · [email protected]

EPSS history

Timeline

02 JAN 16:55Z
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via…
cvelistv5