Critical Emby Server Flaw (CVE-2025-64113) Allows Unauthenticated Admin Takeover

Emby Server has disclosed a critical vulnerability, CVE-2025-64113, that resides in the REST-based API and allows unauthenticated users to seize administrative privileges on unpatched systems, effectively giving an attacker full control over the media server itself. The flaw has a CVSS score of 9.3 and does not grant direct operating system access, but enables management of users, libraries and potentially sensitive data within the server.

The advisory notes that exploitation requires only network access, with no other preconditions, making any internet-facing Emby Server an immediate target; the Emby team responded by deploying a fast “quick fix” through the automatic plugin system to patch many installations quickly. Affected versions are Beta and stable releases ≤ 4.9.1.80 and ≤ 4.9.2.6, with patched versions 4.9.1.90 or 4.9.2.7 available, and administrators are urged to apply these updates as soon as possible, ideally via a full system update.

According to GHSA-95fv-5gfj-2r84, the vulnerability allows an attacker to “gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level)”. 9 December 2025.