The only way to currently reset your admin PIN is to do it using the password that all of your managed users have too. This allows them to change your pin and get into the adminnistrator panel.
It’s a big security risk and verification should be done by email.
Well I would agree with that, but at that point you’re telling me that I shouldn’t even use managed users at all.
The problem is that my brother for example, who is in my actual home, could get into the admin panel without much trouble. He needs the password to actually access his managed user account. This makes PINs useless.
If he’s in your home, perhaps he should be another regular Plex user that’s added to your Plex Home. He would have his own password, and PINs would apply for fast-switching between users.
That’s not the point. The point is you’re not supposed to give managed users your account credentials. The common use case for managed users is e.g. to be used with your kids whom you don’t want to have their own Plex accounts. The “managed” part clearly implies that they’re not in control of things all by themselves – e.g. so you can apply parental controls on them.
From the support article linked above:
Note : Remember that setting a PIN on an account is not a replacement for good account security. A PIN should not be considered true security and is provided as a convenience to help control access when young children are involved. Do not share your account password/credentials with others and do not let others access your account.
If you have other users joining your Plex Home – e.g. your spouse or close relatives – they should have their own Plex account. You can still invite those in your Plex Home, they’ll be able to use fast user switching etc.
In addition they are in control of their own account and won’t need you to sign them in.
TL;DR: if you’re handing out your Plex account’s credentials, you should not be surprised that others will be able to e.g. reset your pin.