Authentication Bypass Vulnerability in Emby Server by Emby

CVE-2025-64325

What is CVE-2025-64325?

Emby Server, a personal media server, is susceptible to an authentication bypass due to improper handling of the X-Emby-Client request header. Malicious users can exploit this vulnerability by sending a crafted authentication request that adds a manipulated client value to the devices section of the admin dashboard without adequate sanitization. This flaw poses a risk of unauthorized access and has been addressed in versions 4.8.1.0 and Beta version 4.9.0.0-beta. For detailed information, refer to the security advisory here.

References