CVE-2025-57800

Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary callback in a cookie, which is later used to redirect the user after authentication. The server then issues a 302 redirect to the attacker-controlled URL, appending sensitive OIDC tokens as query parameters. This allows an attacker to obtain the victim's tokens and perform full account takeover, including creating persistent admin users if the victim is an administrator. Tokens are further leaked via browser history, Referer headers, and server logs. This vulnerability impacts all Audiobookshelf deployments using OIDC; no IdP misconfiguration is required. The issue is fixed in version 2.28.0. No known workarounds exist.

• CWE-523
• CWE-598
• CWE-601

• https://github.com/advplyr/audiobookshelf/commit/99a3867ce934b797e21e6ba5390d4b679e35f7cbPatch
• https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-vpc2-w73p-39pxExploit, Vendor Advisory

Published

Aug 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57795Explorance Blue versions prior to 8.14.13 contain an authent…9.9
• CVE-2025-57796Explorance Blue versions prior to 8.14.12 use reversible sym…6.8
• CVE-2025-57797Incorrect privilege assignment vulnerability exists in ScanS…8.5
• CVE-2025-57798Joplin is an open source note-taking and to-do application t…5.5
• CVE-2025-57799StreamVault is a multi-platform video parsing and downloadin…8.7
• CVE-2025-5780A vulnerability was found in code-projects Patient Record Ma…7.5
• CVE-2025-57801gnark is a zero-knowledge proof system framework. In version…9.1
• CVE-2025-57802Airlink's Daemon interfaces with Docker and the Panel to pro…8.7
• CVE-2025-57803ImageMagick is free and open-source software used for editin…8.8
• CVE-2025-57804h2 is a pure-Python implementation of a HTTP/2 protocol stac…6.9
• CVE-2025-57805The Scratch Channel is a news website. In versions 1 and 1.1…8.7
• CVE-2025-57806Local Deep Research is an AI-powered research assistant for …6.9