PT-2025-34465 · Unknown · Audiobookshelf

Swiftbird07 · Published 2025-08-22 · Updated 2025-08-26 · CVE-2025-57800

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Audiobookshelf versions 2.6.0 through 2.26.3

Description: Audiobookshelf is an open-source self-hosted audiobook server. The application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary callback in a cookie, which is later used to redirect the user after authentication. The server then issues a 302 redirect to the attacker-controlled URL, appending sensitive OIDC tokens as query parameters. This allows an attacker to obtain the victim's tokens and perform full account takeover, including creating persistent admin users if the victim is an administrator. Tokens are further leaked via browser history, Referer headers, and server logs.

Recommendations: Update to version 2.28.0.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-523

CWE-601

CWE-598

Related Identifiers

CVE-2025-57800

GHSA-VPC2-W73P-39PX

Affected Products

Audiobookshelf

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57800.json · Exploit
• https://github.com/advplyr/audiobookshelf/commit/99a3867ce934b797e21e6ba5390d4b679e35f7cb · Patch
• https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-vpc2-w73p-39px · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57800 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57800 · Vendor Advisory
• https://twitter.com/CVEnew/status/1958964669022085365 · Twitter Post
• https://twitter.com/CveFindCom/status/1958947159342014821 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1958949838952771796 · Twitter Post
• https://t.me/CVEtracker/30707 · Telegram Post
• https://t.me/cveNotify/133601 · Telegram Post