CVE-2026-73085

MEDIUM

Audiobookshelf: Refresh Token Accepted on Resource Endpoints

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-73085 has a selected CVSS score of 5.3 (medium).

Description

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

audiobookshelf

Browse advplyr / audiobookshelf
CVE List< 2.36.0affected

References

5