CVE-2025-34158

CVE-2025-34158 is a high-severity vulnerability affecting Plex Media Server versions 1.41.7.x through 1.42.0.x before 1.42.1. It stems from incorrect resource transfer, where the /myplex/account endpoint exposes the server owner's credentials, and a subsequent /api/resources call reveals other accessible servers. This allows an authenticated attacker to gain high confidentiality and low integrity impact with no user interaction, resulting in a CVSS score of 8.5. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered community discussion and media coverage, indicating awareness and potential for future exploitation.