External risk intelligence

Emby Server Administrator Account Takeover Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-64113

Emby Server is a media server application designed to be accessed over a network to stream content. While often used in home environments, it is frequently configured to be internet-facing to allow remote access to media libraries, making it a commonly exposed service reachable from the public internet.

Emby

before 4.9.1.904.9.2.6

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Emby Server could allow unauthorized individuals to gain administrative control over media server settings. This issue affects Emby Server versions prior to 4.9.1.81 and does not require any special network access or conditions to be exploited. The primary concern is to confirm if this type of software is in use and exposed.

Unauthenticated control over media server settings.
Affects widely accessible home media server software.
Confirm usage and network exposure of Emby Server.

Attack Path

How an attacker could exploit the issue

An attacker could reach an Emby Server over the network and gain administrative control without needing any special access or interaction. This vulnerability allows an attacker to control Emby Server administration functions, which could lead to significant compromise of the media server's management capabilities.

Network access is required.
No preconditions need to be met.
Results in full administrative access.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could gain full administrative control over an Emby Server. This means they could potentially modify server settings, access user data managed by the server, and alter its behavior.

Server administrative access.
Unauthenticated network access.
Full control over server settings.

Operational Fix

Recommended remediation, mitigation, and detection steps

For Emby Server, application owners and infrastructure teams are primarily responsible for managing this vulnerability. The first practical step is to identify all instances of Emby Server, determine their network exposure and business criticality, and then confirm the accountable owner for each instance to prioritize remediation efforts.

Identify Emby Server instances and ownership.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Emby Server?

Emby Server is a media management platform that allows users to organize personal video, music, and photo collections. It functions as a centralized hub, streaming this media to various devices like smart TVs, phones, and web browsers. Users typically install it on home computers or network-attached storage devices to manage their own private entertainment libraries.

What does CVE-2025-64113 mean for my Emby Server?

This vulnerability, classified as CWE-640, involves a failure in how the software handles account authentication. In simple terms, the system contains a flaw that permits an unauthenticated party to bypass login requirements and obtain full administrative control. This grants them the ability to change server settings or manage content as if they were the legitimate owner, despite never having permission to access the system.

How does an attacker trigger this vulnerability?

An attacker only needs network reachability to the Emby Server to exploit this flaw. There are no complex preconditions, such as needing an existing account or specific system configurations. If the server is reachable over a network, the vulnerability is active. Conversely, if a server is completely isolated from all networks and only accessible via local physical console access, the remote trigger path is effectively negated.

Is my Emby Server at risk if it is not on the internet?

Halo Surface Signal identifies Emby Server as a service often configured for remote access, which increases the likelihood of exposure. If your server is internet-facing, it is reachable by external actors. While internal-only servers have a smaller attack surface, they remain vulnerable to any malicious actor already present on your local network.

What should I do to secure my Emby installation?

Your first step is to locate all Emby Server instances across your environment to understand where they are running. Once identified, verify their current version number to see if they fall below the fixed release. Prioritize updating these servers to version 4.9.1.81 or later to resolve the underlying authentication flaw and restore secure access control.

References

github.com/EmbySupport/Emby.Security/security/advisories/GHSA-95…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.