Emby Server vulnerabilities

Emby Server prior to version 4.8.1.0 and prior to Beta version 4.9.0.0-beta allows a malicious user to send an authentication request with a manipulated X-Emby-Client value, which gets added to the devices section of the admin dashboard without sanitization.

Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP address.

A vulnerability in Emby Server may allow administrative access to the system, depending on user account settings. An attacker could spoof headers, enabling passwordless login or viewing a list of user accounts that may not have a password configured.

Emby Server versions < 4.6.0.50 is vulnerable to Cross Site Scripting (XSS) vulnerability via a crafted GET request to /web. The vulnerability may allow an attacker to inject malicious script.