CVE-2025-57800
BaseFortify
Publication date: 2025-08-22
Last updated on: 2025-08-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| audiobookshelf | audiobookshelf | From 2.6.0 (inc) to 2.28.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-598 | The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request. |
| CWE-523 | Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server. |
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Audiobookshelf versions 2.6.0 through 2.26.3 involves improper restriction of redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes the application to store an arbitrary callback URL in a cookie. After authentication, the server redirects the user to this attacker-controlled URL, appending sensitive OIDC tokens as query parameters. This allows the attacker to steal the victim's tokens and take over their account, including creating persistent admin users if the victim is an administrator.
How can this vulnerability impact me? :
The vulnerability can lead to full account takeover by an attacker, allowing them to access sensitive user information and perform administrative actions such as creating persistent admin users. Tokens are leaked through browser history, Referer headers, and server logs, increasing the risk of unauthorized access and control over the Audiobookshelf deployment.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Audiobookshelf to version 2.28.0 or later, as this version contains the fix for the vulnerability. No known workarounds exist, so applying the update is the recommended immediate mitigation step.