CVE-2026-73085
Received Received - Intake

Authentication Bypass via Refresh Token in Audiobookshelf

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-09-01
AI Q&A
2026-08-11
EPSS Evaluated
2026-08-30
NVD
CVE-2026-73085
EUVD
EUVD-2026-56553

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
advplyr audiobookshelf 2.36.0
advplyr audiobookshelf to 2.36.0 (exc)
advplyr audiobookshelf 2.26.0
advplyr audiobookshelf 2.35.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Audiobookshelf (versions 2.35.0 and below) involves improper handling of JWT refresh tokens. Refresh tokens, meant only for obtaining new access tokens via /auth/refresh, were incorrectly accepted as valid credentials for API and WebSocket endpoints like /api/me. This allowed unauthorized access to user data because the system failed to distinguish between access tokens and refresh tokens.

Detection Guidance

To detect this vulnerability, check if refresh tokens are being accepted as valid Bearer tokens on API or WebSocket endpoints like /api/me. Monitor for 200 OK responses with user data when using refresh tokens, which should only return 401 Unauthorized. Review authentication logs for improper token type validation in server/auth/TokenManager.js.

Impact Analysis

An attacker could use a stolen refresh token to impersonate a legitimate user and access sensitive endpoints, potentially exposing personal data like listening history or account details. Since refresh tokens are long-lived, this risk persists until the token is revoked or the vulnerability is patched.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to sensitive user data through improper authentication. Refresh tokens, which should only refresh access tokens, were incorrectly accepted as valid credentials for protected endpoints like /api/me, exposing user data without proper validation.

Mitigation Strategies

Update Audiobookshelf to version 2.36.0 or later to fix the improper token type validation issue.

Review authentication logs for unexpected access to endpoints like /api/me using refresh tokens.

Revoke all active sessions and require users to re-authenticate after updating.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73085. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart