CVE-2025-64325 is a critical (CVSS 9.0) stored cross-site scripting flaw in Emby Server. A manipulated X-Emby-Client value in an authentication request was added to the admin dashboard devices list without sanitization. Update to 4.8.1.0, or to beta 4.9.0.0-beta, which patch it.
What's affected
Per the NVD record, Emby Server versions prior to 4.8.1.0 and Beta versions prior to 4.9.0.0-beta are affected. The issue is patched in 4.8.1.0 and in Beta 4.9.0.0-beta. The advisory is GHSA-2gwc-988r-2r7x in the EmbySupport security repository; we could not retrieve its full text, so check it for any extra detail.
The CVSS vector shows a network attack that needs a low privilege account and a user interaction, with a changed scope. In plain terms: someone needs to be able to authenticate to the server, and an administrator has to open the dashboard page where the value is displayed.
How to check if you're exposed
Read the server version in the Emby dashboard and compare it with 4.8.1.0 (stable) or 4.9.0.0-beta (beta). In containers:
docker ps --format '{{.Names}} {{.Image}}'
Then look at who can sign in. Any user, including a low privilege or guest account, is a possible starting point for this class of flaw, so a server with many accounts or open registration is more exposed. Review the devices list in the admin dashboard and look for entries with odd client names or markup in them. If you see one, do not open the page repeatedly. Update first, then remove the entry.
What to do now
- Update to Emby Server 4.8.1.0 or later, or to beta 4.9.0.0-beta or later.
- Review the list of user accounts and remove any you do not need.
- Check the devices section of the admin dashboard for odd client names and clear them after the update.
- Prefer a separate non-admin account for daily use, and open the admin dashboard only when you need it.
- Put the server behind a reverse proxy or VPN if it does not need to be public.
Why it matters
The record lists CWE-79, cross-site scripting, and CWE-116, improper encoding or escaping of output. Both say the same thing: a value that came from a client was written into a page without being made safe for HTML. Here the value was a client name header sent during authentication, and the page was the admin dashboard.
Stored XSS in an admin interface is serious because the victim is the most privileged user. Script that runs in an administrator's browser session can act with that administrator's rights inside the application. The fix escapes or sanitizes the value. The record does not list this CVE as known exploited.
Quick check
Does the attacker need an account?
The CVSS vector shows a low privilege requirement, so an attacker needs to be able to authenticate to the server.
Who is the likely victim?
An administrator who opens the dashboard page that lists devices, per the record.
Sources
Last reviewed: 18 October 2026.
