CVE-2025-64113
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Dec 9, 2025
CISA due date
—
The record
Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| NuGet | MediaBrowser.Server.Core | 0 | 4.9.1.81 |
Related vulnerabilities
- GHSA-95fv-5gfj-2r84 Withdrawn Advisory: Emby Server API Vulnerability allowing to gain administrative access… Same vulnerability
- CVE-2026-81905 Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes… CWE-640
- CVE-2026-71625 An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges… CWE-640
- CVE-2026-82487 A vulnerability was determined in Beetel 450TC3 01.00.00_01. CWE-640
- CVE-2026-19632 The TranslatePress – Translate Multilingual sites with AI Translation plugin for… CWE-640
- CVE-2026-18963 A flaw was found in the reset-credentials flow of the keycloak-services component, which… CWE-640
- CVE-2026-15689 Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset… CWE-640
- CVE-2026-12949 The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via… CWE-640