CVE-2026-73085 in Audiobookshelf
Riassunto
di MITRE • 12/08/2026
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.