Open Request Proxy Vulnerability in Readest E-book Reader

CVE-2026-57566

What is CVE-2026-57566?

The Readest E-book Reader, designed for a seamless and feature-rich experience, has a significant vulnerability that allows unauthenticated access to its /api/opds/proxy route. This flaw enables attackers to provide malicious URLs that the application fetches without any restrictions, posing potential risks of unauthorized data exposure. Attackers can exploit this open request proxy behavior, particularly in self-hosted environments, to retrieve internal-service responses or cloud metadata. Although some deployment environments, like Cloudflare Workers, impose additional restrictions, the fundamental issue remains until users upgrade to version 0.11.10, where this security hole has been addressed.

References