Plex Media Server Token Exposure Vulnerability Allowing Unauthorized Access to Share Tokens

A vulnerability in the Plex Media Server backend can be exploited by non-server device tokens to retrieve share tokens through a shared_servers endpoint. This issue affects Plex Media Server versions prior to 2025-12-31.

Impact

Exploitation of this vulnerability allows unauthorized access to share tokens, which can be used to access resources or services shared with the Plex user.

Reproduction

The vulnerability can be reproduced by authenticating as a non-owner user with shared server access, extracting the access token from network requests, and then requesting the owner's administrative token via the '/myplex/account' endpoint. This owner token can be used to access additional servers and their owner tokens, creating a chain of exploitation.

Remediation

Users are advised to update to Plex Media Server version 1.42.1 or later, where this vulnerability has been patched.