What’s Vulnerable › Vulnerabilities
CVE-2021-25827
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-06-28 · updated 2026-10-24
- Weakness: CWE-290
Description
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
Affected products
- EmbySupport Emby.Security: before 4.7.12.0 — fixed in 4.7.12.0
How to fix
Upgrade to a fixed version: EmbySupport Emby.Security 4.7.12.0. Check the vendor advisory for mitigations.
References
- https://emby.media/community/index.php?/topic/98191-emby-server-46-released/
- https://github.com/EmbySupport/security/security/advisories/GHSA-fffj-6fr6-3fgf
- https://github.com/MediaBrowser/Emby/issues/3784
- https://emby.media/community/index.php?/topic/98191-emby-server-46-released/
- https://github.com/EmbySupport/security/security/advisories/GHSA-fffj-6fr6-3fgf
- https://github.com/MediaBrowser/Emby/issues/3784
Get alerted when CVE-2021-25827 or the next vulnerability affects your stack