CVE-2025-25205
Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.75%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like "/api/items/1/cover" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.
- CVSS 3.1
- 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- EPSS
- 4.75% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-202, CWE-287, CWE-400
- Affected
- audiobookshelf/audiobookshelf
- Source
- security-advisories@github.com
References
- https://github.com/advplyr/audiobookshelf/blob/1a3d70d04100924d41391acb55bd8ddca486a4fa/server/Auth.js#L17-L41Product
- https://github.com/advplyr/audiobookshelf/commit/bf8407274e3ee300af1927ee660d078a7a801e1cPatch
- https://github.com/advplyr/audiobookshelf/commit/ec6537656925a43871b07cfee12c9f383844d224Patch
- https://github.com/advplyr/audiobookshelf/pull/3584Issue Tracking, Patch
- https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvwExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.