Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws

{"#Authentication_Bug":"Plex Media Server 1.43.3 and Plex Desktop 1.115.0 include security patches for vulnerabilities. The most significant issue is CVE-2025-34158, a high-severity authentication bug in the '/myplex/account' endpoint. This bug exposed the server owner's administrative access token, even when accessed by non-owner or lower-privileged users. Additionally, a '/api/resources' API call can reveal other servers accessible by the server owner, potentially exposing the owner's entire Plex infrastructure. These vulnerabilities were exploited in the August 2022 LastPass breach, where attackers used a Plex Media Server vulnerability to gain access to the LastPass server.","#Plex_Media_Server_Vulnerabilities":"Plex has a history of addressing security issues. In February 2021, they released a security update to prevent attackers from causing a denial-of-service (DoS) attack by reflecting UDP packets. In August 2022, a breach of LastPass was driven by attackers implanting keylogger malware on an employee's home computer, which was compromised through a Plex Media Server vulnerability (CVE-2020-5741).","#Vulnerability_Impact":"The vulnerabilities in Plex Media Server have been exploited by threat actors, leading to data breaches and unauthorized access to sensitive information. The August 2022 LastPass breach, for instance, exposed the entire Plex infrastructure of the compromised server, highlighting the severity of these vulnerabilities."}