CVE-2021-25827: Emby

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.

Affected products

• Emby Emby: before 4.7.12.0 (fixed in 4.7.12.0)

Published 2023-06-28. Last modified 2026-06-17.