Open-Source Audiobook Server Vulnerability in Audiobookshelf by Audiobookshelf

CVE-2025-57800

What is CVE-2025-57800?

Audiobookshelf, an open-source self-hosted audiobook server, has a significant flaw in its OIDC authentication process in versions 2.6.0 to 2.26.3. This vulnerability allows an attacker to manipulate redirect callback URLs, posing a serious risk of exposing sensitive OAuth 2.0 tokens through crafted login links. The attack can result in unauthorized access to user accounts and potentially create persistent admin accounts, especially if the victim has administrative privileges. The affected deployments do not require any misconfiguration of Identity Providers (IdPs). It is imperative for users of Audiobookshelf to upgrade to version 2.28.0 or later to mitigate this risk.

References