Emby vulnerabilities
We track 3 vulnerabilities in Emby products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on December 9, 2025.
Latest Emby vulnerabilities
- 9.8 Critical severity
security: Weak Password Recovery Mechanism for Forgotten Password
Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need
- 9.0 Critical severity
Emby.Security: Improper Neutralization of Input During Web Page Generation
Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard
- 9.1 Critical severity
security: Inconsistent Interpretation of HTTP Requests
Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative