Unknown · Audiobookshelf · CVE-2026-42887
**Name of the Vulnerable Software and Affected Versions**
Audiobookshelf versions prior to 2.33.0
**Description**
A stored cross-site scripting (XSS) issue exists in the Login Page. This occurs because the `/api/auth-settings` endpoint does not properly sanitize the `authLoginCustomMessage` field. An attacker with administrative privileges can inject arbitrary HTML or JavaScript, which is then rendered on the login page for all users.
**Recommendations**
Update to version 2.33.0.