CVE-2025-69416: Plex Media Server

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml.

Affected products

• Plex Media Server: up to and including 1.43.0.10389

Published 2026-01-02. Last modified 2026-10-07.