CVE-2026-73085
Summary
by MITRE • 08/11/2026
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in Audiobookshelf affects versions prior to 2.36.0 and stems from a critical flaw in the token authentication mechanism within the server/auth/TokenManager.js file. The jwtAuthCheck function fails to properly distinguish between different types of JSON Web Tokens, specifically treating refresh tokens as if they were bearer access tokens. This misclassification occurs when processing API and WebSocket requests to endpoints such as /api/me, which should normally require valid access tokens rather than refresh tokens for authentication purposes.
The technical flaw represents a violation of proper token management principles where the system does not enforce the intended security boundaries between different token types. Refresh tokens are designed to be used exclusively for obtaining new access tokens through specific endpoints like /auth/refresh, while access tokens should be the sole means of authenticating user requests to protected resources. This confusion allows an attacker who has obtained a refresh token to directly access user resources without the need to first exchange it for a proper access token, effectively bypassing the intended authentication flow.
The operational impact of this vulnerability is significant as it enables unauthorized access to user data and functionality through the use of refresh tokens alone. An authenticated user or attacker with access to a refresh token can leverage this flaw to gain full access to their account resources, including personal audiobook collections, listening history, and potentially sensitive configuration settings. This undermines the fundamental security model of token-based authentication systems and could lead to data exposure, unauthorized modifications, or complete account compromise.
This vulnerability aligns with CWE-287 which addresses improper authentication issues in software applications, specifically targeting weaknesses in authentication mechanisms that allow tokens to be used outside their intended scope. The flaw also relates to ATT&CK technique T1566 which covers credential harvesting through various means including token manipulation and exploitation of authentication flaws. The security gap represents a failure in implementing proper token type validation and authorization checks within the application's authentication layer, creating an attack surface where refresh tokens can be misused as access tokens.
The fix implemented in version 2.36.0 addresses this by properly enforcing token type validation within the jwtAuthCheck function, ensuring that refresh tokens are only accepted at the designated refresh endpoint while access tokens are required for resource endpoints. Organizations should immediately upgrade to version 2.36.0 or later to mitigate this risk and ensure proper token lifecycle management. Additionally, administrators should review existing user sessions and consider revoking refresh tokens if there's any suspicion of compromise, as the vulnerability could have been exploited during the affected version timeframe to gain unauthorized access to user accounts and their associated audiobook collections.