# CVE-2023-33193: Emby Server - Authentication Bypass

> Live exploitation tracking for CVE-2023-33193 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-33193

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.1
- **Public exploit available:** Yes
- **Affected products:** Emby Server
- **Weaknesses:** CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
- **Tags:** web_application, file_sharing

## Description

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers which are intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination to allow logging in without password or to view a list of user accounts which may have no password configured. Impacted are all Emby Server system which are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users. This issue has been patched in Emby Server Beta version 4.8.31 and Emby Server version 4.7.12.

## CrowdSec analysis

[CVE-2023-33193](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-33193) is a critical authentication bypass vulnerability in Emby Server that could allow attackers to gain administrative access by spoofing headers, particularly when the server is publicly accessible and account login configurations are not properly secured. Exploiting this flaw may enable unauthorized users to log in without a password or enumerate user accounts, posing a significant risk of unauthorized control and data exposure.

CrowdSec has been tracking this vulnerability and its exploits since 14th of January 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2023-33193 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
CrowdSec network telemetry also shows that exploitation of CVE-2023-33193 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit this vulnerability by sending requests to `/emby/users/public` with the `X-Forwarded-For: 127.0.0.1` header, allowing them to bypass authentication and enumerate user accounts or gain administrative access.

## Timeline

- 2023-05-30: CVE Published. CVE-2023-33193 is published to NVD.
- 2026-01-14: Rule Released. CrowdSec releases a rule to detect CVE-2023-33193 exploitation attempts against the CrowdSec Network.
- 2026-01-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-33193 for the first time.

## References

- https://github.com/EmbySupport/security/security/advisories/GHSA-fffj-6fr6-3fgf
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-33193.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-33193) follows observed exploitation activity for CVE-2023-33193. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.