CVE-2025-64113 is a critical (CVSS 9.8) flaw in Emby Server that lets an attacker with network access gain full administrative control of the Emby application. The NVD record names 4.9.1.81 as the fixed version. Update the server, and see the version note below.
What's affected
The NVD record says versions below 4.9.1.81 are affected and that 4.9.1.81 fixes the issue. The advisory text we retrieved reads slightly differently: it says the issue affects Emby Server 4.9.1.80 and prior, and Emby Server Beta 4.9.2.6 and prior, and that patched versions exist for both stable and beta.
These two statements describe the same stable boundary. The beta line is the wrinkle: if you run a beta, do not rely on the 4.9.1.81 number. Check the vendor advisory for the beta build that contains the fix.
The advisory also notes that a quick fix was rolled out through an update to a default included Emby plugin, because plugin updates are usually applied automatically. Do not treat that as a reason to skip the server update.
One more point on scope. Per the record, the attacker gains control of Emby Server administration, not the operating system underneath.
How to check if you're exposed
Open the Emby dashboard and read the server version on the main page. Compare it with the stable fix, 4.9.1.81, or the matching beta fix named in the advisory.
If you run Emby in a container, check the tag:
docker ps --format '{{.Names}} {{.Image}}'
Then decide how exposed the server is. The record says no special preconditions apply beyond network access, so a server reachable from the internet through a port forward or reverse proxy has the highest risk. A server that sits on a private network only is lower risk, but still worth updating. Check the Emby user list for administrator accounts or password changes you did not make.
What to do now
- Update Emby Server to 4.9.1.81 or later on the stable channel, or to the fixed beta build named in the advisory if you run beta.
- If you cannot update at once, take the server off the internet or restrict it to a VPN or a short list of addresses.
- Review administrator accounts, API keys and recent configuration changes. Remove any you do not recognize and rotate passwords.
- Note that the advisory describes an interim workaround based on file permissions for a password reset file and calls it obsolete. Update instead of relying on it.
- Make sure your Emby plugins update automatically, since the vendor used that channel for its quick fix.
Why it matters
The record classes this as CWE-640, weak password recovery mechanism for forgotten password. The advisory's own workaround text points the same way: it refers to a password reset file in the configuration folder and to the ForgotPassword API, so the flaw sits in the recovery path rather than in normal sign in. We have not seen the full technical write up, and we will not guess further than the advisory does.
Media servers get exposed to the internet more often than most admin tools, because people want to watch from anywhere. A critical flaw with no preconditions on a server like that is a good reason to update promptly. This CVE is not in the CISA Known Exploited Vulnerabilities catalog according to the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this give an attacker control of my operating system?
The record says the access is to Emby Server administration, not at the OS level. An admin inside a media server can still do harm, so treat it seriously.
Which version is safe?
Stable 4.9.1.81 or later. For beta builds check the vendor advisory, because the advisory text lists beta 4.9.2.6 and prior as affected.
Sources
Last reviewed: 18 October 2026.
