CVE-2025-25205

Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like "/api/items/1/cover" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.

• CWE-202
• CWE-287
• CWE-400

• https://github.com/advplyr/audiobookshelf/blob/1a3d70d04100924d41391acb55bd8ddca486a4fa/server/Auth.js#L17-L41Product
• https://github.com/advplyr/audiobookshelf/commit/bf8407274e3ee300af1927ee660d078a7a801e1cPatch
• https://github.com/advplyr/audiobookshelf/commit/ec6537656925a43871b07cfee12c9f383844d224Patch
• https://github.com/advplyr/audiobookshelf/pull/3584Issue Tracking, Patch
• https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-pg8v-5jcv-wrvwExploit, Vendor Advisory

Published

Feb 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2520The Honeywell Experion PKS contains an Uninitialized Variabl…7.5
• CVE-2025-25200Koa is expressive middleware for Node.js using ES2017 async …7.5
• CVE-2025-25201Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB ke…4
• CVE-2025-25202Ash Authentication is an authentication framework for Elixir…6.5
• CVE-2025-25203CtrlPanel is open-source billing software for hosting provid…8.1
• CVE-2025-25204`gh` is GitHub’s official command line tool. Starting in ver…6.3
• CVE-2025-25206eLabFTW is an open source electronic lab notebook for resear…8.8
• CVE-2025-25207The Authorino service in the Red Hat Connectivity Link is th…5.7
• CVE-2025-25208A Developer persona can bring down the Authorino service, pr…5.7
• CVE-2025-25209The AuthPolicy metadata on Red Hat Connectivity Link contain…5.7
• CVE-2025-2521The Honeywell Experion PKS and OneWireless WDM contains a Me…8.6
• CVE-2025-25210Improper input validation for some Server Firmware Update Ut…8.2