CVE-2025-64325

Critical

Published: 18/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Emby Server prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta allows a malicious user to send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization.

Risk Assessment

Risk of injecting malicious content into the admin dashboard, potentially leading to XSS attacks or other security breaches.

Recommendation

Update to version 4.8.1.0 or Beta 4.9.0.0-beta which contains the fix.

Original NVD description (English source)

Emby Server is a personal media server. Prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta, a malicious user can send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization. This issue has been patched in version 4.8.1.0 and Beta version 4.9.0.0-beta.