Emby Server CVE-2025-64113

Exploitation requires only network reachability to the Emby Server HTTP API; per the advisory, 'other than network access, no specific preconditions need to be fulfilled.' The weakness is in the password-reset flow associated with the passwordreset.txt file in the Emby configuration folder (CWE-640 weak password recovery), reachable without authentication (PR:N) and without user interaction (UI:N) against default configurations of Emby Server versions <= 4.9.1.80 (stable) and <= 4.9.2.6 (beta). Limiting factors: the server must be network-accessible to the attacker; impact is confined to Emby Server application administration and does NOT grant OS-level access; and the obsolete pre-patch mitigation was setting restrictive (DENY / chmod 444) permissions on passwordreset.txt, which blocked the vulnerable API call.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no authentication and no user interaction, with high confidentiality, integrity and availability impact to the vulnerable Emby Server application. CWE-640 (weak password recovery mechanism) combined with the withdrawn advisory's workaround - restricting permissions on the configuration folder's passwordreset.txt file - confirms the flaw is an abusable account/password-reset path that yields full Emby administrative access. The signals partially conflict on urgency: EPSS is only 0.59% (47th percentile), indicating no statistical evidence of widespread exploitation yet, and there is no CISA KEV listing and no public exploit identified at time of analysis, so this is a trivially exploitable but not-yet-mass-exploited issue. Note the SSVC/technical-impact picture is favorable to attackers (total control of the application, automatable given PR:N/UI:N), but impact is explicitly bounded to Emby Server administration and NOT OS-level access, which caps blast radius. One data caveat: the input's Tags label this 'Information Disclosure' while the actual impact is administrative takeover/authentication bypass - the information-disclosure framing likely reflects the password-reset token being readable, but the net effect is account takeover, so treat the tag as incomplete.

An attacker who can reach an Emby Server's HTTP API over the network (e.g., a server exposed to the internet or accessible on the LAN) abuses the weak password-reset mechanism tied to the passwordreset.txt file to reset or obtain administrator access without any credentials or user interaction. No public exploit code was identified at time of analysis, but given AV:N/AC:L/PR:N the attack is low-effort and reliably reproducible against unpatched servers.