advplyr audiobookshelf up to 2.27.x Redirect Call unprotected transport of credentials

Summaryinfo

A vulnerability labeled as critical has been found in advplyr audiobookshelf up to 2.27.x. Impacted is an unknown function of the component Redirect Call Handler. Such manipulation leads to unprotected transport of credentials. This vulnerability is listed as CVE-2025-57800. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in advplyr audiobookshelf up to 2.27.x. It has been rated as critical. Affected by this issue is an unknown part of the component Redirect Call Handler. The manipulation with an unknown input leads to a unprotected transport of credentials vulnerability. Using CWE to declare the problem leads to CWE-523. Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary callback in a cookie, which is later used to redirect the user after authentication. The server then issues a 302 redirect to the attacker-controlled URL, appending sensitive OIDC tokens as query parameters. This allows an attacker to obtain the victim's tokens and perform full account takeover, including creating persistent admin users if the victim is an administrator. Tokens are further leaked via browser history, Referer headers, and server logs. This vulnerability impacts all Audiobookshelf deployments using OIDC; no IdP misconfiguration is required. The issue is fixed in version 2.28.0. No known workarounds exist.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-57800 since 08/20/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1557.

Upgrading to version 2.28.0 eliminates this vulnerability. Applying the patch 99a3867ce934b797e21e6ba5390d4b679e35f7cb is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• advplyr

Name

• audiobookshelf

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27

License

• open-source

Website

• Product: https://github.com/advplyr/audiobookshelf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion