Emby Randomly Created a Photos and Home Videos Library??

[pigpog8 8]

Today I just noticed a Photos and Home Videos library on my app's home below my other libraries. I did not authorize this and I don't believe it's tied to Camera Upload features since they seemed to be a random compilation of folders from my computer's Downloads folder, some other folders, some thumbnails. I immediately deleted it as I don't want that content shared with my other users (close friends and family). What prompted Emby to do this?? And how can I prevent this in the future?

I do not have logs, as I don't know when it was created (I just barely noticed it today), and as I've said I immediately deleted it to prevent access from other users.

[Luke 42077]

Hi, Emby wouldn’t just create a library. Does it show in Emby library setup?

[pigpog8 8]

1 hour ago, Luke said:

Hi, Emby wouldn’t just create a library. Does it show in Emby library setup?

It did show, and I had to go there to delete the library. I am the only admin (besides my wife but she never plays around the Admin settings) so it was a shock to see it there, available to all users. I can’t think of what else caused it

Edited December 9, 2025 by pigpog8
Wording

[Luke 42077]

What was the name of it?

[pigpog8 8]

17 minutes ago, Luke said:

What was the name of it?

It was called Photos and Home Videos. Something neither of us would create. And I can’t remember which folders were selected to import since I deleted it so quickly, but it was about 8-10 including Downloads

[Luke 42077]

When did it start showing up?

[pigpog8 8]

1 hour ago, Luke said:

When did it start showing up?

Unfortunately I only noticed it today while I was at work, I’m not exactly sure when it showed up. But it can’t have been before last week, I had added a new library (not this one we’re discussing, a different one for kids shows and movies for my daughter) and would have noticed it when picking the order of the libraries.

[pigpog8 8]

1 hour ago, Luke said:

When did it start showing up?

I was able to find the log file that has the name of the library for the first time, it looks like it was created early this morning - though I can’t make much sense of it. I searched for Home Video and found the first mention.

and way before that, I find a ton of entries like this, some kind of MediaProbeManager that begins digging through a ton of videos and photos I have in folders I never imported into Emby:

Quote

2025-12-08 02:53:06.814 Info MediaProbeManager: ProcessRun 'ffprobe' Execute: C:\Users\Julius\AppData\Roaming\Emby-Server\system\ffprobe.exe -i file:"C:\Users\Julius\Downloads\32 lethal gab fall streamladder-Replay 2023-11-20 20-16-42.mp4" -threads 0 -v info -print_format json -show_streams -show_chapters -show_format -show_data
2025-12-08 02:53:06.890 Info MediaProbeManager: ProcessRun 'ffprobe' Process exited with code 0
2025-12-08 02:53:06.891 Info SingleImageExtractor: ProcessRun 'extract-image' Execute: C:\Users\Julius\AppData\Roaming\Emby-Server\system\ffmpeg.exe -ss 00:00:05.497  -f mp4 -threads 1 -i file:"C:\Users\Julius\Downloads\32 lethal gab fall streamladder-Replay 2023-11-20 20-16-42.mp4" -an -sn -threads 0 -vf "thumbnail=24" -f image2 -b:v 100M "C:\Users\Julius\AppData\Roaming\Emby-Server\programdata\cache\temp\f4ebd243-0f52-4134-8418-0483d6df7419.jpg"

embyserver-63900811046.txt

Edited December 9, 2025 by pigpog8
Added log details

[Luke 42077]

Line 4999 is when the library was created. Do all of your users have passwords?

[brothom 177]

6 hours ago, Luke said:

Line 4999 is when the library was created. Do all of your users have passwords?

Agreed, this seems to be a security issue somehow.  To be fair, I always thought leaving an empty password / no password would only allow users to login via Emby Connect but apparently I was wrong. 

[pigpog8 8]

7 hours ago, Luke said:

Line 4999 is when the library was created. Do all of your users have passwords?

Not all users, no. The only users who do not are my 2 year old daughter's account, a Guest account that is only used when we have company (it's been a few months since then), and a dormant account I plan on setting up for my In-laws. Are you suggesting somehow that someone else accessed the server and manually made that library?

Also I have seen a few failed authentications every few nights (starting at line 148) with my User Profile, which I just thought something wasn't connecting temporarily (using Arr apps, and it looks like it calls out Notifiarr several times around those failed authentications.)

Edited December 9, 2025 by pigpog8

[pigpog8 8]

45 minutes ago, brothom said:

Agreed, this seems to be a security issue somehow.  To be fair, I always thought leaving an empty password / no password would only allow users to login via Emby Connect but apparently I was wrong. 

Should I always set passwords for my profiles? I only give access to the server by assigning profiles to my close friends and family, having them create accounts first. As I said above, there are only a few profiles without a password, and I don't have anyone else on my network besides my wife.

[Neminem 1518]

Have a look at this.

 

33 minutes ago, pigpog8 said:

Should I always set passwords for my profiles?

YES !!!

As Dev's will not force you to, because of reasons unknown.

[brothom 177]

34 minutes ago, pigpog8 said:

Should I always set passwords for my profiles? I only give access to the server by assigning profiles to my close friends and family, having them create accounts first. As I said above, there are only a few profiles without a password, and I don't have anyone else on my network besides my wife.

Yep thats what I used to do too, after I found out that users without a password can just login directly without a password.
Set them to an impossibly complicated password and disable password change.

Regardless, maybe one of your users also has admin priviledges? Only admins should be able to create/update libraries.

[Neminem 1518]

Also look at this.

 

[pigpog8 8]

1 hour ago, Neminem said:

Have a look at this.

 

YES !!!

As Dev's will not force you to, because of reasons unknown.

 

1 hour ago, brothom said:

Yep thats what I used to do too, after I found out that users without a password can just login directly without a password.
Set them to an impossibly complicated password and disable password change.

Regardless, maybe one of your users also has admin priviledges? Only admins should be able to create/update libraries.

 

1 hour ago, Neminem said:

Also look at this.

 

Woah guys, this is crazy stuff. I guess I thought I wouldn't have to worry about any of this because I make sure to never give out my external IP, and I thought Emby Connect made their accounts safe. I don't have local passwords for anyone. I will need to add passwords to all profiles and disallow external access on my admin profile. I'll need to continue going through the linked posts when I'm off work. I had no idea my server was so vulnerable... I'm guessing the creation of that library was a bad actor using my admin profile to attempt to steal images from my computer???

I also blacklisted the IP (which, similar to the post @Neminemshared, was in another country) that showed up around the failed authentication attempts. Hopefully that will help temporarily while I get all this sorted out.

Edited December 9, 2025 by pigpog8

[Neminem 1518]

Everything with a connection to the internet is at risk

Its up to admins to see the risks and act accordantly.

But to relay on Emby connect without a local password is a bad option.

The internet is scanned every day for open routers / software / hardware.

And if not secured will be under attack.

Edit.

And even if you feel secure today, you might not be tomorrow.

I know this is sad, but the truth.

Edited December 9, 2025 by Neminem

[pigpog8 8]

20 minutes ago, Neminem said:

Everything with a connection to the internet is at risk

Its up to admins to see the risks and act accordantly.

But to relay on Emby connect without a local password is a bad option.

The internet is scanned every day for open routers / software / hardware.

And if not secured will be under attack.

Edit.

And even if you feel secure today, you might not be tomorrow.

I know this is sad, but the truth.

I appreciate the insight and help. I've added passwords to all accounts on the server, and turned off remote connections on the local ones. My wife just called and said her profile is prompting for a password, so I know it worked (though I'm guessing the pin I set will only work after she authenticates with PW?). My remote users shouldn't notice a difference since they use Emby Connect, correct?

I also checked all of the boxes below for all users (although I left the first one unchecked for local accounts, correct?)

• Hide this user from login screens on the local network
• Hide this user from login screens when connected remotely 
• Hide this user from login screens on devices they've never signed into

Lastly, I planned on leaving Remote Access on for my profile, though I did set a password. Will it be alright?

Sorry for all of the questions, this was quite scary.

[Neminem 1518]

TBH if that is in place you should be, ok.

But If your user is also admin, then I would make a separat admin user, that only has access from your lan.

[pigpog8 8]

4 minutes ago, Neminem said:

TBH if that is in place you should be, ok.

But If your user is also admin, then I would make a separat admin user, that only has access from your lan.

So make a a separate admin account (and as I read on the other posts you linked, don't name it admin lol), and remove admin access from my profile? And of course hide that account from everything, yes?

[Neminem 1518]

@pigpog8

I just read this in another topic.

Where you said this.

"Only myself and my wife have admin access"

In this case you should create 2 new accounts, yours and wife's, and make then admin, and remove all admin rights for the old.

That way you have admin rights at home ( Switching users ) and normal remote accounts.

Normal accounts should also be used when watching media.

Admin accounts should only be used as such, to admin.

[Neminem 1518]

4 minutes ago, pigpog8 said:

So make a a separate admin account (and as I read on the other posts you linked, don't name it admin lol), and remove admin access from my profile? And of course hide that account from everything, yes?

Yes

[pigpog8 8]

23 minutes ago, Neminem said:

@pigpog8

I just read this in another topic.

Where you said this.

"Only myself and my wife have admin access"

In this case you should create 2 new accounts, yours and wife's, and make then admin, and remove all admin rights for the old.

That way you have admin rights at home ( Switching users ) and normal remote accounts.

Normal accounts should also be used when watching media.

Admin accounts should only be used as such, to admin.

I created that separate admin profile, named it something obscure, and removed admin from my wife's and my account. She doesn't necessarily need admin access, and if I'm trying to remotely administrate the server, I can use Google Remote Desktop to use the admin account on my PC "locally." Does that work just the same?

[Neminem 1518]

3 minutes ago, pigpog8 said:

I created that separate admin profile, named it something obscure, and removed admin from my wife's and my account

Yes that would be for the best.

4 minutes ago, pigpog8 said:

and if I'm trying to remotely administrate the server, I can use Google Remote Desktop to use the admin account on my PC "locally." Does that work just the same?

It should, but your are using Google neverminde, having a bit fun.

Look into setting up a wireguard VPN server, and use that to connect as if your are local with you admin account.

[pigpog8 8]

1 hour ago, Neminem said:

Yes that would be for the best.

It should, but your are using Google neverminde, having a bit fun.

Look into setting up a wireguard VPN server, and use that to connect as if your are local with you admin account.

lol I know probably not the best. I actually am currently using a VPN (PIA) with wireguard to… obtain media to add to Emby. I’m using the split tunneling feature so that only my download program uses it, and everything else bypasses. Whenever I wasn’t using split tunneling, my server was not able to be access remotely even via Emby Connect. 
I’ll have to look into how to use it as a remote access client, I wasn’t aware that that was an option.