Plex Media Server is the most widely deployed commercial media streaming platform with over 50 million users, used both in home and small business environments for personal media libraries. Its security model is built around the X-Plex-Token header — a single authentication token that provides access to the media library, server administration, and user management without further verification. Tokens extracted from Plex's Preferences.xml configuration file, the SQLite database, traffic interception, or the Plex web app's local storage give complete server access; Plex's GDM (G'Day Mate) discovery protocol broadcasts server presence via UDP on ports 32412 and 32414, making any Plex server discoverable to all devices on the local network without credentials; Plex servers configured to allow access without Plex.tv account login using a PIN accept brute force attacks due to limited PIN complexity (4-8 digits); shared library access through Plex Home and managed accounts creates a permission model that is often misconfigured — home users with unnecessary server access can view other users' watch history and libraries; and Plex's remote access feature routes traffic through Plex relay servers when direct connection fails, exposing the server to the internet via Plex's infrastructure even without explicit firewall rules. This guide covers systematic Plex Media Server security assessment.
# X-Plex-Token: Plex's primary auth mechanism
# Sources: Preferences.xml, SQLite DB, browser localStorage, traffic proxy
PLEX_URL="https://plex.example.com:32400"
# Or via Plex relay: https://app.plex.tv direct connections
# Common token locations on the Plex Media Server host:
# Linux: /var/lib/plexmediaserver/Library/Application\ Support/Plex\ Media\ Server/Preferences.xml
# macOS: ~/Library/Application\ Support/Plex\ Media\ Server/Preferences.xml
# Windows: %LOCALAPPDATA%\Plex Media Server\Preferences.xml
# Docker: /Library/Application Support/Plex Media Server/Preferences.xml
# Extract token from Preferences.xml (requires filesystem access)
grep -oP '(?<=PlexOnlineToken=")[^"]+' \
"/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Preferences.xml" \
2>/dev/null | head -1
# Test a captured token against the server
PLEX_TOKEN="your-captured-token"
curl -s "${PLEX_URL}/?X-Plex-Token=${PLEX_TOKEN}" \
-H "Accept: application/json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
ms = d.get('MediaContainer',{})
print(f'Server: {ms.get(\"friendlyName\",\"?\")}')
print(f'Version: {ms.get(\"version\",\"?\")}')
print(f'Owned: {ms.get(\"myPlex\",\"?\")}')
" 2>/dev/null
# Enumerate libraries with token
curl -s "${PLEX_URL}/library/sections?X-Plex-Token=${PLEX_TOKEN}" \
-H "Accept: application/json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
dirs = d.get('MediaContainer',{}).get('Directory',[])
for lib in dirs:
print(f\"Library: {lib.get('title','?')} type={lib.get('type','?')} items={lib.get('count','?')}\")
" 2>/dev/null | Security Test | Method | Risk |
|---|---|---|
| X-Plex-Token in Preferences.xml | Read Preferences.xml from data volume or filesystem — token gives full library + admin access; also extractable from SQLite DB at com.plexapp.plugins.library.db | Critical |
| GDM discovery on LAN | Listen on UDP 32412/32414 — GDM response reveals server name, version, IP, and port without authentication for all Plex servers on the local network | Medium |
| Remote access via Plex relay | Plex relay routes internet traffic to your server when direct connection fails — server exposed to internet via relay.plex.tv even with firewall blocking port 32400 | High |
| Access without Plex account PIN brute force | 4-8 digit PIN with limited rate limiting — enumerate PIN space to gain Plex access without a Plex.tv account | High |
| Shared home user over-privilege | Home users with server access can view other users' watch history and access all shared libraries — review Managed Accounts permissions | Medium |
| Token in browser localStorage | Browser DevTools → localStorage["myPlexAccessToken"] or ["plexToken"] — extracts token from shared/compromised browser profile | High |
Ironimo tests Plex Media Server deployments for X-Plex-Token exposure in Preferences.xml and configuration files giving full library and admin access, GDM UDP discovery broadcasting server presence to all LAN devices without authentication, remote access via Plex relay enabling internet connectivity even when firewall rules block port 32400, PIN brute force for "access without Plex account" configurations, shared home user over-privilege providing access to other users' watch history and libraries, and token extraction from browser local storage in shared device scenarios.
Start free scan