Plex Media Server CVE-2025-69414

Exploitation requires the attacker to already possess a valid transient (short-lived) Plex access token; with that token, an authenticated /myplex/account request returns a permanent access token, escalating temporary access into durable account access on Plex Media Server builds through 1.42.2.10156. The key limiting factor is this prerequisite credential - this is not a from-zero unauthenticated compromise (PR:L), so realistic risk depends on how easily transient tokens can be acquired (e.g., shared links, intercepted flows, or low-privilege sessions). No user interaction or non-default configuration is required beyond running an affected version.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, base 7.1) describes a network-exploitable, low-complexity flaw requiring some prior privilege - specifically possession of a transient access token (PR:L) - with high confidentiality impact and low integrity impact. This aligns with CWE-863 (improper authorization): a short-lived transient token is improperly accepted by the /myplex/account endpoint to mint a permanent access token, effectively escalating a temporary credential into durable account access. Real-world risk signals are mixed: a public POC reportedly exists, which raises the exploitation floor, but EPSS is very low (0.04%, 13th percentile) and the CVE is NOT in CISA KEV, indicating no confirmed active exploitation and low predicted mass-exploitation likelihood. The dominant limiting factor is the PR:L prerequisite - an attacker must first obtain a valid transient token, so this is an escalation/credential-persistence primitive rather than a from-zero remote takeover. NOTE: the single reference URL points to research for CVE-2025-34158, not CVE-2025-69414 - the linked 'exploit' reference is a probable reference mismatch and its applicability to this specific token-escalation issue should be verified before treating POC availability as confirmed for this exact CVE.

An attacker who has obtained a transient (short-lived, limited) Plex access token - for example captured from a shared link, intercepted flow, or a low-privilege session - issues a /myplex/account call and receives a permanent account access token in response. That permanent token grants durable access to the victim's Plex account, surviving the expiry of the original transient credential. A public proof-of-concept is referenced, though the linked write-up appears to be for a different CVE and should be verified.