# Security Issue - Plex Login Bug with Profiles **URL:** \ **Category:** General Discussions\ **Tags:** plex-web\ **Created:** [February 25, 2025, 10:47pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015 "2025-02-25T22:47:39Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![janf0](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@janf0](https://forums.plex.tv/u/janf0)\ **Post date:** [February 25, 2025, 10:47pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/1 "2025-02-25T22:47:39Z")
Hi, i found a bigger security issue with login to plex. On a new Device, if you login first with your E-Mail-Address and Password, then there are no cookies set, therefore it logs you in as admin-profile. You not to type in your PIN for the profile. This should be checked and fixed asap. Kind regards. ---
**Author:** ![tom80H](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/tom80h/32/19753_2.png) [@tom80H](https://forums.plex.tv/u/tom80H)\ **Post date:** [February 25, 2025, 11:00pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/2 "2025-02-25T23:00:28Z")
This is by design. Managed users cannot sign into a new device by themselves – they need the admin of the Plex Home to sign into the device. Only then can you switch the user and change to their profile. You should not share your credentials with managed users (or any other users for what it’s worth). [https://support.plex.tv/articles/203948776-managed-users/](https://support.plex.tv/articles/203948776-managed-users/) ---
**Author:** ![janf0](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@janf0](https://forums.plex.tv/u/janf0)\ **Post date:** [February 25, 2025, 11:05pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/3 "2025-02-25T23:05:21Z")
Hi, the problem is not that the login is with the admin-profile, the problem is that without cookies the first login attempt / or deleting cookies lead automatically into Admin-Permission which can´t be wanted by design. ---
**Author:** ![tom80H](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/tom80h/32/19753_2.png) [@tom80H](https://forums.plex.tv/u/tom80H)\ **Post date:** [February 25, 2025, 11:09pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/4 "2025-02-25T23:09:38Z")
I might be missing something 😉 If I open the web app in a private window (no cookies), Plex won’t recognize my previously signed in account and ask me to login. I can’t see it automatically signing in as the admin?! ---
**Author:** ![janf0](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@janf0](https://forums.plex.tv/u/janf0)\ **Post date:** [February 25, 2025, 11:11pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/5 "2025-02-25T23:11:27Z")
i meant, sign in … then normally with cookies appears the page with the profiles, where you have to select your profile and type in the pin. this isn´t the case if cookies are deleted or not there. ---
**Author:** ![tom80H](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/tom80h/32/19753_2.png) [@tom80H](https://forums.plex.tv/u/tom80H)\ **Post date:** [February 25, 2025, 11:13pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/6 "2025-02-25T23:13:09Z")
If you delete the cookies… are you still signed in as the admin? ---
**Author:** ![janf0](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@janf0](https://forums.plex.tv/u/janf0)\ **Post date:** [February 25, 2025, 11:16pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/7 "2025-02-25T23:16:41Z")
Yes, and as i said, if i relogin with email and password, i automatically are in with admin-profile, no profile pin, nothing. after reload then the profile page where i have to choose the profile and type in the pin appears. As i said, thats a big security issue. A hacker is with the first login without cookie directly admin and can do anything he wants. ---
**Author:** ![tom80H](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/tom80h/32/19753_2.png) [@tom80H](https://forums.plex.tv/u/tom80H)\ **Post date:** [February 25, 2025, 11:24pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/8 "2025-02-25T23:24:42Z")
If there’s no cookies, the web app won’t remember who you are and won’t authenticate you as admin (or anyone, actually). Sorry, if I’m thick… I have a feeling I’m missing something you’re trying to tell me. Maybe something about the part where I perceive you mean to delete cookies after you’re signed in with the admin account (but before switching users)??? # > [@janf0](#): > > if i relogin with email and password, i automatically are in with admin-profile, no profile pin, nothing. Yes; that’s by design and as described above. > [@janf0](#): > > after reload then the profile page where i have to choose the profile and type in the pin appears. Or if you opt to switch users. That’s expected / by design. > [@janf0](#): > > A hacker is with the first login without cookie directly admin and can do anything he wants. This is where you lost me. ---
**Author:** ![janf0](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@janf0](https://forums.plex.tv/u/janf0)\ **Post date:** [February 25, 2025, 11:28pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/9 "2025-02-25T23:28:15Z")
So you want to tell me that, if i login on another notebook, browser, etc. it is ok on an longer existing Plex Media Server that at first login the not appearance of the profile-selection is ok by design ? sounds weird for me, but ok ---
**Author:** ![tom80H](https://sea1.discourse-cdn.com/plex/user_avatar/forums.plex.tv/tom80h/32/19753_2.png) [@tom80H](https://forums.plex.tv/u/tom80H)\ **Post date:** [February 25, 2025, 11:36pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/10 "2025-02-25T23:36:12Z")
That’s exactly what I wrote in my first response. The first login on a “new” device can only be done by the admin. The admin might do some config to the app (e.g. enabling `Automatically sign in` if they want that device to be used exclusively by one of their managed users). A managed user can’t just login with their device (given they don’t have a password). The need the admin to login first and then to switch users. ---
**Author:** ![system](https://global.discourse-cdn.com/plex/original/3X/2/a/2acb9765406f63293d357b4ec509ec39aa28f2ad.png) [@system](https://forums.plex.tv/u/system)\ **Post date:** [May 26, 2025, 11:36pm UTC](https://forums.plex.tv/t/security-issue-plex-login-bug-with-profiles/907015/11 "2025-05-26T23:36:26Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.