CVE-2021-25827
CRITICALEmby < 4.7.12.0 - Authentication Bypass via X-Forwarded-For Header Spoofing
Title source: llmDescription
Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address.
References (3)
Core 3
Core References
Exploit, Issue Tracking, Third Party Advisory
https://github.com/MediaBrowser/Emby/issues/3784
Scores
CVSS v3
9.8
EPSS
0.0117
EPSS Percentile
63.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-290
Status
published
Products (1)
emby/emby
< 4.7.12.0
Published
Jun 28, 2023
Tracked Since
Feb 18, 2026