CVE-2025-34158

CVSS 3.1: 8.5 high
EPSS: <1%p44
Published: Aug 21, 2025 · Aug 21, 2025
Modified: Jun 17, 2026

Analyze CVE-2025-34158 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).

Weakness: CWE-669

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news

4 stories

Plex tells users to change passwords due to data breach, pushes server owners to upgrade

Help Net SecuritySep 9, 00:00 UTC · Sep 9, 2025Data breachCVE-2025-341582 · 1 read

300k+ Plex Media Server instances still vulnerable to attack via CVE-2025-34158

Help Net SecuritySep 4, 15:09 UTC · Sep 4, 2025VulnerabilityCVE-2025-34158 CVE-2020-57411

Week in review: 300k+ Plex Media Server instances still vulnerable to attack, exploited Git RCE flaw

Help Net SecurityAug 31, 00:00 UTC · Aug 31, 2025VulnerabilityCVE-2025-34158 CVE-2025-48384 CVE-2025-77753

Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws

Plex patched multiple undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0, urging all users to update immediately.

The Hacker NewsSep 4, 07:35 UTC · Sep 4, 2026VulnerabilityCVE-2025-34158 CVE-2020-57411