CVE-2025-34158: Plex Media Server

High severity, CVSS 8.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).

Affected products

• Plex Media Server: from 1.41.7, before 1.42.1 (fixed in 1.42.1)

Published 2025-08-21. Last modified 2026-06-17.