Swiftbird07

Name of the Vulnerable Software and Affected Versions: Audiobookshelf versions 2.6.0 through 2.26.3 Description: Audiobookshelf is an open-source self-hosted audiobook server. The application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary callback in a cookie, which is later used to redirect the user after authentication. The server then issues a 302 redirect to the attacker-controlled URL, appending sensitive OIDC tokens as query parameters. This allows an attacker to obtain the victim's tokens and perform full account takeover, including creating persistent admin users if the victim is an administrator. Tokens are further leaked via browser history, Referer headers, and server logs. Recommendations: Update to version 2.28.0.

**Name of the Vulnerable Software and Affected Versions** Audiobookshelf versions 2.17.0 through 2.19.0 **Description** A flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings such as "/api/items/1/cover" within the `r` query parameter to partially bypass authentication or trigger server crashes on specific routes. This may result in the disclosure of protected information or a complete denial of service if the downstream code expects an authenticated user object. **Recommendations** Update to version 2.19.1.