Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
Plex released emergency patches in Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address multiple undisclosed security flaws, with CVE identifiers pending A previously disclosed high-severity vulnerability (CVE-2025-34158, CVSS 8.5) involved an authentication bug at the "/myplex/account" endpoint that exposed server owners' administrative access tokens to lower-privileged users An exploit chain combining "/myplex/account" and "/api/resources" endpoints could reveal an owner's entire Plex
Analysis
TL;DR
- Plex released emergency patches in Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to address multiple undisclosed security flaws, with CVE identifiers pending
- A previously disclosed high-severity vulnerability (CVE-2025-34158, CVSS 8.5) involved an authentication bug at the "/myplex/account" endpoint that exposed server owners' administrative access tokens to lower-privileged users
- An exploit chain combining "/myplex/account" and "/api/resources" endpoints could reveal an owner's entire Plex infrastructure to unauthorized access
- Over 360,000 devices expose the Plex Media Server web interface according to Censys data, though not all are vulnerable
- Plex has a history of exploited vulnerabilities, including a 2021 UDP reflection DoS issue and a 2020 vulnerability (CVE-2020-5741) linked to the LastPass breach
Why It Matters
This highlights the ongoing security risks associated with self-hosted media servers that are frequently exposed to the public internet, making them attractive targets for threat actors. The pattern of undisclosed vulnerabilities followed by emergency patches underscores the importance of proactive update management for any internet-facing service.
Technical Details
- Patched Versions: Plex Media Server 1.43.3 and Plex Desktop 1.115.0 contain fixes for multiple undisclosed flaws; CVE identifiers have been requested but not yet assigned
- CVE-2025-34158 (CVSS 8.5): Authentication bypass vulnerability where the "/myplex/account" endpoint incorrectly exposed the server owner's account details and administrative access token to any authenticated non-owner or lower-privileged user
- Exploit Chain: The combination of "/myplex/account" (token exposure) and "/api/resources" (infrastructure enumeration) creates a two-step attack path that can map an owner's entire Plex deployment
- Attack Surface: Censys data indicates over 360,000 devices expose the Plex Media Server web interface to the internet, significantly expanding the potential attack surface
- Historical Vulnerabilities: Includes CVE-2020-5741 (CVSS 7.2, exploited in the LastPass breach via keylogger deployment) and a 2021 UDP reflection vulnerability addressed in v1.21.3.4014
Industry Insight
- Organizations and individuals running Plex Media Server should treat this as a critical priority and update immediately, especially those with internet-facing deployments or NAS-based installations that may lag in package manager updates
- The recurring pattern of severe vulnerabilities in Plex suggests that self-hosted media servers require the same rigorous security hygiene as enterprise infrastructure, including network segmentation, regular patching, and exposure minimization
- The LastPass breach connection demonstrates how consumer-grade software vulnerabilities can cascade into enterprise-level incidents, reinforcing the need for zero-trust principles even in personal infrastructure
Disclaimer: The above content is generated by AI and is for reference only.