Server Version#: 4.88.1
Player Version#: PS4 no idea sub version
So, my son over the years has had room mates. He signs in to my plex account and then leave and that gets left behind. I have been able to cut off everyone that has happened with, except this one. I am still planning a password change but that impacts several people, so I am planning it more appropriately. I Noticed this weird thing. I have killed every device I don’t know what it is in my authorized devices log for Ples Server. Yet he still keeps getting in to play movies on his PS4.
Let me know if you find the answer. I experienced this after resetting my password after the recent data breach.
Even though I reset my password and “signed out” all devices, even manually deleted all authorized devices, most all previously authorized devices still have access. Seems to be a deeper issue with Plex authentication, possibly a vulnerability.
In the meantime, you can put a pin on the users. That should do the trick to prevent unauthorized users access for now.
Edit: it appears to be a 4yr old bug, you can see the post I made about it. Currently, even resetting the password won’t remove the PS4s access, you will definitely need to put a pin on your managed users to stop the unauthorized access until this issue is addressed by Plex.
I did find the entry in the devices list on the server database. I was trying to fix an issue a show or movie continually show as recently added. while I had the database open, I looked at the devices table. There it was, the PS4 that when I look in the interface is not there. Sitting in the database.
I was able to resolve my other issue by finding the EP and deleting and reimporting them. When the new metadata came in it fixed the recently added list. but the database no matter what our how I open it is always read only so I can’t remove the PS4 that will not go away.
If you’re talking about the “devices” table, that doesn’t hold the authorization.
I just tested by deleting my phone and was still able to access. I believe the data may be held in the CloudAccessVs.dat file as that one was updated once I logged my phone back in, but it isn’t updated when deleting an authorized device.
I don’t think this issue has a simple solution, other than adding a pin to your users.
