# Major security issue? **URL:** \ **Category:** General Discussions\ **Created:** [December 31, 2023, 5:33am UTC](https://forums.plex.tv/t/major-security-issue/864594 "2023-12-31T05:33:23Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 5:33am UTC](https://forums.plex.tv/t/major-security-issue/864594/1 "2023-12-31T05:33:23Z")
A friend, whom I share 3 libraries with, was logging into his iOS app, and was able to gain full access to my account (as if he was logged into me). ---
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 5:35am UTC](https://forums.plex.tv/t/major-security-issue/864594/2 "2023-12-31T05:35:47Z")
Here is a screen share of how he’s getting access. [![](https://img.youtube.com/vi/A9-lpLj3NfU/hqdefault.jpg "Plex Security Issue") ](https://www.youtube.com/watch?v=A9-lpLj3NfU) ---
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 5:37am UTC](https://forums.plex.tv/t/major-security-issue/864594/3 "2023-12-31T05:37:22Z")
Here is the view of my Plex Home with the accounts he created. ![image](https://global.discourse-cdn.com/plex/original/4X/b/d/4/bd441153c4c96f84af9071b6879af56ccae33fdb.jpeg) ---
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 5:40am UTC](https://forums.plex.tv/t/major-security-issue/864594/4 "2023-12-31T05:40:10Z")
Here is the Library Access for that user: ![image](https://global.discourse-cdn.com/plex/original/4X/d/c/6/dc6c11e084fa02939a77f1bf946885ee069ae76d.jpeg) ---
**Author:** ![CapMarkoRamius](https://avatars.discourse-cdn.com/v4/letter/c/5e9695/32.png) [@CapMarkoRamius](https://forums.plex.tv/u/CapMarkoRamius)\ **Post date:** [December 31, 2023, 5:51am UTC](https://forums.plex.tv/t/major-security-issue/864594/5 "2023-12-31T05:51:30Z")
You don’t have a PIN set for your user. That’s the main problem. Managed users “are you”, and the PIN is what protects them once you actually login. ---
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 5:57am UTC](https://forums.plex.tv/t/major-security-issue/864594/7 "2023-12-31T05:57:00Z")
How does that matter? - [morris.justin@gmail.com](mailto:morris.justin@gmail.com) This is the guy that randomly got access which is also applying on his account here somehow. What’s hilarious is we can both type at the same time since this text input is socketed. - [nathan.hyland@gmail.com](mailto:nathan.hyland@gmail.com) This also happens when I’m connected to my local synology hosted plex, it immediately adds the user to his account and won’t let me add a user to my own. - [nathan.hyland@gmail.com](mailto:nathan.hyland@gmail.com) @CapMarkoRamius I’d say the main problem is that I’m not morris and I’m typing as him. - [nathan.hyland@gmail.com](mailto:nathan.hyland@gmail.com) ---
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 6:03am UTC](https://forums.plex.tv/t/major-security-issue/864594/8 "2023-12-31T06:03:36Z")
Just to summarize what has happened. A user ([nathan.hyland@gmail.com](mailto:nathan.hyland@gmail.com), who was never and is not a managed user) with access to just 3 libraries on my account was able to gain FULL admin access to my account. - [morris.justin@gmail.com](mailto:morris.justin@gmail.com) ---
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 6:05am UTC](https://forums.plex.tv/t/major-security-issue/864594/9 "2023-12-31T06:05:07Z")
Still [nathan.hyland@gmail.com](mailto:nathan.hyland@gmail.com) here. [![](https://img.youtube.com/vi/bXt9waOkb90/hqdefault.jpg "Plex Security Issue") ](https://www.youtube.com/watch?v=bXt9waOkb90) I can’t sign in, sign up, create users, etc on my own account. ---
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 6:08am UTC](https://forums.plex.tv/t/major-security-issue/864594/10 "2023-12-31T06:08:10Z")
[morris.justin@gmail.com](mailto:morris.justin@gmail.com) here: Here is what I see on my side now after the above video: ![image](https://global.discourse-cdn.com/plex/original/4X/7/5/0/75088deb6995b0e7c370d5fa4f35acc4046a31c3.jpeg) ---
**Author:** ![DTR](https://avatars.discourse-cdn.com/v4/letter/d/9fc348/32.png) [@DTR](https://forums.plex.tv/u/DTR)\ **Post date:** [December 31, 2023, 7:41am UTC](https://forums.plex.tv/t/major-security-issue/864594/11 "2023-12-31T07:41:35Z")
None of your home users have PINs, which means you can all impersonate each other with a few clicks due to the nature of Plex Homes: [Consequences of Being in a Plex Home | Plex Support](https://support.plex.tv/articles/203960236-consequences-of-being-in-a-plex-home/): > ### When You Switch, You Become That User > > When you switch to another user, you really are switching to that user. You effectively _BECOME_ that user. That means that you have the same access as that user: > > - If the user runs a Plex Media Server, you can access and change the Server settings > - You can see libraries shared with that user (either in the Home or shared from outside the Home) > - You can view (and, in many cases, change) their account information > > > **Warning!** : Remember that you should only join a Plex Home if you completely trust the Home Admin. You should set a PIN on your account if you don’t want other users switching to you, but do not rely on the PIN as actual, true security. Even if you do set a PIN, it’s not intended as a foolproof security feature. If you don’t want other users to potentially gain access to your account, add them as regular friends ([Managing Library Access | Plex Support](https://support.plex.tv/articles/201105738-creating-and-managing-server-shares/)), not home users. ---
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 7:49am UTC](https://forums.plex.tv/t/major-security-issue/864594/12 "2023-12-31T07:49:53Z")
[nathan.hyland@gmail.com](mailto:nathan.hyland@gmail.com) was NEVER a home user. He still isn’t a home user. ![image](https://global.discourse-cdn.com/plex/original/4X/d/4/c/d4c0da36aef32aa0a4f5703426ecc07d0498c6bd.png) ![image](https://global.discourse-cdn.com/plex/original/4X/2/f/5/2f553b8568af90ad06a5c4aa2ed8263be27834f5.jpeg) ---
**Author:** ![JaysPlex](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/jaysplex/32/281767_2.png) [@JaysPlex](https://forums.plex.tv/u/JaysPlex)\ **Post date:** [December 31, 2023, 8:41am UTC](https://forums.plex.tv/t/major-security-issue/864594/13 "2023-12-31T08:41:19Z")
Did you join his Plex home? If so leave it ---
**Author:** ![morris.justin\_gmail.com](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/morris.justin_gmail.com/32/108656_2.png) [@morris.justin\_gmail.com](https://forums.plex.tv/u/morris.justin_gmail.com)\ **Post date:** [December 31, 2023, 8:45am UTC](https://forums.plex.tv/t/major-security-issue/864594/14 "2023-12-31T08:45:41Z")
No, I did not join [nathan.hyland@gmail.com](mailto:nathan.hyland@gmail.com) home. ---
**Author:** ![OttoKerner](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/ottokerner/32/10079_2.png) [@OttoKerner](https://forums.plex.tv/u/OttoKerner)\ **Post date:** [December 31, 2023, 2:12pm UTC](https://forums.plex.tv/t/major-security-issue/864594/15 "2023-12-31T14:12:59Z")
Are you two sharing any hardware or software tools? Did someone of you use old hardware of the other, or restored a backup of the other? Did you two establish a VPN between your respective home networks, so as to access each other’s home network? Is one of you currently visting the other, so that a computer/device of one user is now located within the home network of the other user? ---
**Author:** ![Yaracuy](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/yaracuy/32/313162_2.png) [@Yaracuy](https://forums.plex.tv/u/Yaracuy)\ **Post date:** [December 31, 2023, 2:36pm UTC](https://forums.plex.tv/t/major-security-issue/864594/16 "2023-12-31T14:36:42Z")
The login in this forum - and actually all the `.plex.tv` domain - plays together with the credentials of the user currently logged in the Web app on your Plex server as long as you use the same browser - there is a `plex_tv_auth` cookie set to `.plex.tv` with your info - , so if Nathan switched to Morris (who doesn’t have a PIN) and opened the forum and posted on it, it would be as Morris. Not as Nathan. That’s one thing. But if the following is true - and no reason to think it isn’t - it deserves a closer look because this could be a real issue. > [@morris.justin\_gmail.com](#): > > A user ([nathan.hyland@gmail.com](mailto:nathan.hyland@gmail.com), who was never and is not a managed user) with access to just 3 libraries on my account was able to gain FULL admin access to my account. But Morris - assuming you are the one posting as you -, how did you give Nathan access to your libraries? “Invite Plex User”? ---
**Author:** ![nhyland](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/nhyland/32/315165_2.png) [@nhyland](https://forums.plex.tv/u/nhyland)\ **Post date:** [December 31, 2023, 4:51pm UTC](https://forums.plex.tv/t/major-security-issue/864594/17 "2023-12-31T16:51:37Z")
Morning! This is [nathan.hyland@gmail.com](mailto:nathan.hyland@gmail.com). I’ve got Morris added to my account. When I login to my account, I see the below: ![Screenshot 2023-12-31 at 9.48.01 AM](https://global.discourse-cdn.com/plex/original/4X/0/7/9/079798e1e7d4f792be61110f9389a521e11aa886.jpeg) I can straight up click on his user and it switches to his admin account. I invited him with the “Invite User” functionality. I wasn’t under the impression that meant I’d be able to access all of his stuff. Here’s what it looks like after I click his account: ![Screenshot 2023-12-31 at 9.50.18 AM](https://global.discourse-cdn.com/plex/original/4X/8/1/b/81b28adaf90fa1df06477d58ba29f07c4dacaf38.png) After I do that, I can’t switch to my account. I have to fully log out and then log in to be able to go back to mine. And no matter what, I can’t invite a user. If I log in to my account, _don’t_ click his account, and try to add a user, it looks like it switches directly over to Morris’s account. I get that he doesn’t have a pin but this definitely seems strange to me. After I log in with my user, I do see this screen: ![Screenshot 2023-12-31 at 9.52.42 AM](https://global.discourse-cdn.com/plex/original/4X/1/b/9/1b92a1795e48420ddfc48ab7350f70defda299aa.jpeg) And after I select Nateflix, I can go to library access and I see the following: ![Screenshot 2023-12-31 at 9.53.04 AM](https://global.discourse-cdn.com/plex/original/4X/2/4/8/248a77c4c7cc35d4329f337cc759ba7e0cff0d20.jpeg) ![Screenshot 2023-12-31 at 9.54.58 AM](https://global.discourse-cdn.com/plex/original/4X/3/1/b/31b4df5ef658350b4089a54d51538e945a85f7e4.jpeg) ![Screenshot 2023-12-31 at 9.55.07 AM](https://global.discourse-cdn.com/plex/original/4X/4/a/0/4a09e85a2a0bd3648c07aa7639870d9c6879db89.jpeg) ![Screenshot 2023-12-31 at 9.55.16 AM](https://global.discourse-cdn.com/plex/original/4X/9/8/0/980089457b39785f0afd7695188cce741cacc262.jpeg) Hope this helps. ---
**Author:** ![SwiftPanda16](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/swiftpanda16/32/81839_2.png) [@SwiftPanda16](https://forums.plex.tv/u/SwiftPanda16)\ **Post date:** [December 31, 2023, 5:01pm UTC](https://forums.plex.tv/t/major-security-issue/864594/18 "2023-12-31T17:01:36Z")
@OttoKerner They have two Plex Home admins in the same Plex Home (notice two users with the crown icon). This shouldn’t be possible. A Plex employee needs to look at their accounts in the backend. ---
**Author:** ![nhyland](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/nhyland/32/315165_2.png) [@nhyland](https://forums.plex.tv/u/nhyland)\ **Post date:** [December 31, 2023, 5:13pm UTC](https://forums.plex.tv/t/major-security-issue/864594/19 "2023-12-31T17:13:01Z")
That’s what was pretty suspect about it to me. Seemed weird to have two ‘crowns’ on one account but I figured it was just because we both had plex passes. ![Screenshot 2023-12-31 at 10.21.14 AM](https://global.discourse-cdn.com/plex/original/4X/8/a/f/8afdfcdcef7a93a57e3269cb4fd0646bb3d3dff3.jpeg) Also, verified: I’ve got morris as a home admin. ---
**Author:** ![OttoKerner](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/ottokerner/32/10079_2.png) [@OttoKerner](https://forums.plex.tv/u/OttoKerner)\ **Post date:** [December 31, 2023, 5:40pm UTC](https://forums.plex.tv/t/major-security-issue/864594/20 "2023-12-31T17:40:05Z")
I’ve filed a bug report. ---
**Author:** ![nhyland](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/nhyland/32/315165_2.png) [@nhyland](https://forums.plex.tv/u/nhyland)\ **Post date:** [December 31, 2023, 5:42pm UTC](https://forums.plex.tv/t/major-security-issue/864594/21 "2023-12-31T17:42:51Z")
Do you need anything else from me or should I remove Morris from my Plex (if I can) so none of my managed users can sign in as him? [Next page](https://forums.plex.tv/t/major-security-issue/864594.md?page=2)